This vulnerability exists in the Core component of Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an attacker with low privileges and network access via SAML to compromise the server, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle’s Critical Patch Update for July 2026 includes many patches but does not explicitly confirm patch availability or remediation level for this vulnerability. No known exploits in the wild have been reported as of the publication date.

Successful exploitation can lead to complete compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products relying on WebLogic Server may also be impacted. This could allow attackers to take over the server and potentially disrupt or manipulate services dependent on it.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple vulnerabilities including those in Oracle WebLogic Server. However, the advisory does not explicitly confirm patch availability or remediation status for CVE-2026-60206. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Until explicit patch confirmation is available, monitor vendor communications for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated.