SURIQ
Oracle's July 2026 Critical Patch Update was defined by the flaws that need no login: a run of unauthenticated remote code execution bugs in WebLogic and the middleware around it, several scored a perfect 10.0. The entry now carrying a public exploit is a quieter one that most teams filed under later. CVE-2026-60206 is a CVSS 9.9 weakness in how Oracle WebLogic Server handles single sign-on, and on 25 July a proof-of-concept exploit for it appeared on GitHub. If you run WebLogic, this one moved up your list today.
What CVE-2026-60206 actually is
According to the NVD record and Oracle's July advisory, the flaw lives in the Core component of Oracle WebLogic Server. An attacker who already holds some minor access on the network can abuse the way WebLogic accepts SAML, the Security Assertion Markup Language behind single sign-on, and finish in full control. Oracle rates the impact at maximum across the board: data can be read, data can be changed, and the service can be taken down. The score also carries a scope change, which is Oracle's way of saying a break-in here can reach components beyond WebLogic itself.
Four release lines carry the bug: 12.2.1.4.0 and 15.1.1.0.0 at the ends, with 14.1.1.0.0 and 14.1.2.0.0 in between. There is no separate hotfix to chase, since applying the July 2026 Critical Patch Update closes it.
Why a low-privilege flaw jumped the queue
On paper CVE-2026-60206 asks more of an attacker than the 10.0 bugs did. It needs some low-level access rather than none, which is exactly why it was easy to rank behind the no-login flaws on patch day. Two things change that math.
The first is the flaw class. The public repository describes forging a valid-looking SAML login through techniques like XML signature wrapping (XSW) and injecting unsigned assertions, then riding that forged identity to administrative access. We are not linking or reproducing exploit steps, and the value for a defender is not the mechanics anyway. It is that the barrier to a working attack just dropped from theoretical to someone published code. The second is history: WebLogic has been mass-exploited from the internet before, repeatedly, once a reliable technique goes public. Treat the low-privilege caveat as thin cover, not comfort.
To be precise about status: as of writing, CVE-2026-60206 is not in CISA's Known Exploited Vulnerabilities catalog, and there is no confirmed exploitation in the wild. Its Exploit Prediction Scoring System rating sits near the 37th percentile. The urgency is the combination of a critical score, a widely deployed product, and now public exploit code, not a report of active attacks. That combination is usually the front edge of one, not a reason to wait for it.
How to tell if someone forged their way in
Patching closes the hole. It does not tell you whether anyone walked through it first, and a forged SAML login is built to look like a legitimate one. So the detection question is specific: can you tell a real single sign-on from a fabricated one? A few signals separate them.
- WebLogic accepting SAML assertions that are unsigned, or whose signature does not match the surrounding response. That mismatch is the fingerprint of signature wrapping.
- Administrative sessions or role grants with no matching login event at your identity provider. A genuine single sign-on admin login has a corresponding issuance on the provider side; a forged one does not, so the two logs disagree.
- Access to the WebLogic administration console or the SAML assertion-consumer endpoint from networks that never normally reach them.
In MITRE ATT&CK terms this is Forge Web Credentials: SAML Tokens (T1606.002). A managed detection service watches for exactly these authentication anomalies and maps them to ATT&CK, but the core tell, an admin session that your identity provider never issued, is one you can alert on yourself today.
What to do now
- Apply Oracle's July 2026 Critical Patch Update to every affected WebLogic instance, meaning the 12.2, 14.1 and 15.1 release lines Oracle names.
- Until you patch, keep the administration console and the SAML single sign-on endpoints off untrusted networks, behind a VPN or an allowlist. Network reachability is a precondition for this attack, so removing it buys real time.
- Review your WebLogic SAML configuration so unsigned assertions are rejected and signatures are validated against the whole response, not just the assertion body.
- Hunt backward through your admin authentication logs for the anomalies above. Do not assume the patch evicts an attacker who already forged access before you applied it.
The 10.0 flaws earned the headlines this month, and rightly so. But CVE-2026-60206 is the one that just got a public exploit, and login forgery on a server this widely deployed is a story that tends to keep moving. Patch it as if it already has.