https://vulnerability.circl.lu/sightings/feed 2026-09-13T11:25:39.676311+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/09ca8587-d208-4623-8a06-5410151a6ed3/export 2026-09-13T11:25:39.703899+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "09ca8587-d208-4623-8a06-5410151a6ed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "creation_timestamp": "2026-09-06T00:01:04.334674Z"} 2026-09-06T00:01:04.334674+00:00 https://vulnerability.circl.lu/sighting/47e9cc1a-6d51-42ec-a404-aba32cce9b92/export 2026-09-13T11:25:39.705536+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "47e9cc1a-6d51-42ec-a404-aba32cce9b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "creation_timestamp": "2026-09-05T01:00:04.912414Z"} 2026-09-05T01:00:04.912414+00:00 https://vulnerability.circl.lu/sighting/50f6653d-a5bf-4fd1-9cd0-606ff8293469/export 2026-09-13T11:25:39.705679+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "50f6653d-a5bf-4fd1-9cd0-606ff8293469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://gist.github.com/alon710/2ed2ec5aa094c7ca5a79e63f27744f8a", "content": "# CVE-2026-60206: CVE-2026-60206: Unauthenticated SAML Authentication Bypass in Oracle WebLogic Server\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60206\n\n## Summary\nA critical vulnerability (CVE-2026-60206) in Oracle WebLogic Server allows unauthenticated or low-privileged attackers to bypass SAML authentication controls. This flaw stems from improper validation of XML signatures and parsing discrepancies in SAML assertions, allowing arbitrary administrative session creation.\n\n## TL;DR\nUnauthenticated SAML authentication bypass in Oracle WebLogic Server leading to administrative console access and remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306 / CWE-287\n- **Attack Vector**: Network\n- **CVSS v3.1**: 9.9\n- **EPSS Score**: 0.00541\n- **Impact**: Administrative Takeover / Remote Code Execution\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Oracle WebLogic Server 12.2.1.4.0\n- Oracle WebLogic Server 14.1.1.0.0\n- Oracle WebLogic Server 14.1.2.0.0\n- Oracle WebLogic Server 15.1.1.0.0\n- **WebLogic Server**: 12.2.1.4.0 (Fixed in: `Patch Applied`)\n- **WebLogic Server**: 14.1.1.0.0 (Fixed in: `Patch Applied`)\n- **WebLogic Server**: 14.1.2.0.0 (Fixed in: `Patch Applied`)\n- **WebLogic Server**: 15.1.1.0.0 (Fixed in: `Patch Applied`)\n\n## Mitigation\n\n- Apply Oracle July 2026 Critical Patch Update (CPU)\n- Restrict access to WebLogic admin console ports (7001/7002)\n- Implement Web Application Firewall (WAF) inspection rules for SAML XML payloads\n\n**Remediation Steps:**\n1. Download the patch corresponding to your WebLogic Server version from Oracle Support.\n2. Use the OPatch utility to apply the patch to the WebLogic Server home directory.\n3. Restart the WebLogic Server domains to apply the security changes.\n4. Verify the patch installation using 'opatch lsinventory'.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60206) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T10:01:40.198478Z"} 2026-09-03T10:01:40.198478+00:00 https://vulnerability.circl.lu/sighting/3b74f528-b05a-4477-b4c0-55049abc8c24/export 2026-09-13T11:25:39.705804+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3b74f528-b05a-4477-b4c0-55049abc8c24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17649", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-29T00:00:28.883038Z"} 2026-08-29T00:00:28.883038+00:00 https://vulnerability.circl.lu/sighting/f847a005-f198-4ea0-a6f5-463b1d6d1c4b/export 2026-09-13T11:25:39.705928+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "f847a005-f198-4ea0-a6f5-463b1d6d1c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17649", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T04:00:05.448749Z"} 2026-08-28T04:00:05.448749+00:00 https://vulnerability.circl.lu/sighting/9f4fa4ed-60ad-427d-b1de-c205749a896c/export 2026-09-13T11:25:39.706042+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9f4fa4ed-60ad-427d-b1de-c205749a896c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/34997", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:14.339318Z"} 2026-08-16T00:00:14.339318+00:00 https://vulnerability.circl.lu/sighting/eb161683-02c6-4e4c-91ae-29eea6e1228b/export 2026-09-13T11:25:39.706152+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "eb161683-02c6-4e4c-91ae-29eea6e1228b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/34997", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T18:00:05.112271Z"} 2026-08-15T18:00:05.112271+00:00 https://vulnerability.circl.lu/sighting/91788e35-b563-435b-808a-2874c4c7b736/export 2026-09-13T11:25:39.706263+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "91788e35-b563-435b-808a-2874c4c7b736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/timb.me.uk/post/3msl7co37trt2", "content": "Interesting Git repos of the week:\n\nDetection:\n\n* https://github.com/Yamato-Security/WELA - improve your Windows logging\n\nBugs:\n\n* https://github.com/timb-machine-mirrors/imbas007-POC-CVE-2026-60206 - popping WebLogic via SAML\n\nExploitation:\n\n* https://github.com/Mrnmap/RedTeam - a nice list of [\u2026]", "creation_timestamp": "2026-08-08T13:44:21.580712Z"} 2026-08-08T13:44:21.580712+00:00 https://vulnerability.circl.lu/sighting/e24ed049-e92a-46cf-8f2d-ff5cc3006210/export 2026-09-13T11:25:39.706357+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e24ed049-e92a-46cf-8f2d-ff5cc3006210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrrl5ssapn2y", "content": "\ud83d\udccc CVE-2026-60206 - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.... https://www.cyberhub.blog/cves/CVE-2026-60206", "creation_timestamp": "2026-07-29T09:07:07.870203Z"} 2026-07-29T09:07:07.870203+00:00 https://vulnerability.circl.lu/sighting/ba1bc07e-afdf-42d8-980f-fc46e000acff/export 2026-09-13T11:25:39.706450+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "ba1bc07e-afdf-42d8-980f-fc46e000acff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95022", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60206-PoC-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 21:44:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udc7e CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework \u26a1Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. \ud83d\udee1\ufe0f CVSS 9.9 Critical - Use Ethically, Stay Legal. \ud83d\udd12\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-26T00:00:47.824021Z"} 2026-07-26T00:00:47.824021+00:00