CVE-2026-60364 is a critical security vulnerability in the Oracle WebLogic Server Proxy Plug-in for third-party web servers, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the proxy plug-in, resulting in unauthorized creation, deletion, or modification of critical data accessible through the plug-in. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes multiple patches for various products but does not explicitly confirm a patch for this vulnerability. Users should verify patch availability and apply updates as recommended by Oracle.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle WebLogic Server Proxy Plug-in, allowing an attacker to create, delete, or modify critical data without authentication. This can result in unauthorized data manipulation and potential takeover of the Oracle HTTP Server environment. The vulnerability impacts confidentiality, integrity, and availability at a high level, as reflected by the CVSS score of 9.8.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-60364, Oracle strongly recommends that customers remain on actively supported versions and apply all security patches without delay. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Patch status for this vulnerability is not yet confirmed; therefore, checking the vendor advisory for current remediation guidance is essential.