{"vulnerability": "CVE-2026-60206", "sightings": [{"uuid": "91788e35-b563-435b-808a-2874c4c7b736", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/timb.me.uk/post/3msl7co37trt2", "content": "Interesting Git repos of the week:\n\nDetection:\n\n* https://github.com/Yamato-Security/WELA - improve your Windows logging\n\nBugs:\n\n* https://github.com/timb-machine-mirrors/imbas007-POC-CVE-2026-60206 - popping WebLogic via SAML\n\nExploitation:\n\n* https://github.com/Mrnmap/RedTeam - a nice list of [\u2026]", "creation_timestamp": "2026-08-08T13:44:21.580712Z"}, {"uuid": "eb161683-02c6-4e4c-91ae-29eea6e1228b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/34997", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T18:00:05.112271Z"}, {"uuid": "9f4fa4ed-60ad-427d-b1de-c205749a896c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/34997", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:14.339318Z"}, {"uuid": "50f01455-4b25-4cd3-a227-543dc41e9230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6wcnzhy22u", "content": "CVE-2026-60206 - oracle weblogic server\nOracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are at risk of being taken over by attackers who can access the server via a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oraclecorporation #CVE #infosec", "creation_timestamp": "2026-07-21T23:06:05.526012Z"}, {"uuid": "0fab6f1b-fbb0-4967-9d10-37f1c72e8387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mra2rw3efd2e", "content": "Oracle's July 2026 patch fixes 11 Oracle WebLogic Server vulnerabilities. CVE-2026-60206 rates CVSS 9.9 and allows full server takeover. Patch now.\n\n#OracleWebLogic #CVE202660206 #WebLogicServer #OracleCPU #RCE #InfoSec", "creation_timestamp": "2026-07-22T09:58:52.668454Z"}, {"uuid": "d59c1a6b-2992-42d9-8213-580c44b9b1e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9", "content": "", "creation_timestamp": "2026-07-23T16:47:59.689412Z"}, {"uuid": "477f76ac-aecb-436c-ae6d-ea320265be12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://t.me/GithubRedTeam/94894", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-60206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 02:46:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncve cve-2026-60206 weblogic saml exploit poc vulnerability oracle scanner security\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-24T04:00:04.007736Z"}, {"uuid": "ce1185ef-9f82-4bb1-8e11-93de876cb9a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "Telegram/CAgNXP7QCJ0ImmaZujxERj5g-FS7jqScPpLDOt1x7u-ghTY", "content": "", "creation_timestamp": "2026-07-24T12:00:04.377357Z"}, {"uuid": "ce81eee3-3ceb-406b-a55c-20740ac42518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://t.me/GithubRedTeam/95022", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60206-PoC-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 21:44:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udc7e CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework \u26a1Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. \ud83d\udee1\ufe0f CVSS 9.9 Critical - Use Ethically, Stay Legal. \ud83d\udd12\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-25T00:00:08.920117Z"}, {"uuid": "58bb1905-a7b6-47cd-82b5-650e7f52311d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/CAgNXP7QCJ0ImmaZujxERj5g-FS7jqScPpLDOt1x7u-ghTY", "content": "", "creation_timestamp": "2026-07-25T00:00:10.598229Z"}, {"uuid": "b5402ac5-7393-476f-807c-f9f97b79fd7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94894", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a POC-CVE-2026-60206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a imbas007\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 02:46:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\ncve cve-2026-60206 weblogic saml exploit poc vulnerability oracle scanner security\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-25T01:00:05.142111Z"}, {"uuid": "07a35b83-6a5a-4593-8bd7-d1b5afeaafa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "Telegram/MD-MwBd_W8uwTqsEvI7HPalRa1bGoxdlVd6D-EmkL4FhnPg", "content": "", "creation_timestamp": "2026-07-25T04:00:03.861608Z"}, {"uuid": "f847a005-f198-4ea0-a6f5-463b1d6d1c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17649", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T04:00:05.448749Z"}, {"uuid": "521ccd39-3408-438d-b8b0-abade2b52ca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/MD-MwBd_W8uwTqsEvI7HPalRa1bGoxdlVd6D-EmkL4FhnPg", "content": "", "creation_timestamp": "2026-07-26T00:00:46.783165Z"}, {"uuid": "0379a87f-c70f-4655-b59c-0bf0bc1be926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-25T23:00:03.252565Z"}, {"uuid": "68cf41cc-fc36-4db1-abfa-4e5bb6112ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "Telegram/nPdorxgilRpeUK74owvb_SQJPx7ceIG4883buRWavnmG2X8", "content": "", "creation_timestamp": "2026-07-25T20:00:03.438983Z"}, {"uuid": "f0036b1d-4e49-4990-9b20-530115f8d563", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mri73xj6oi2v", "content": "\u26a0\ufe0f PATCH NOW\n\nA public exploit is out for a critical Oracle WebLogic flaw (CVE-2026-60206) that forges a login to take over the server.\n\nRated CVSS 9.9, it hits WebLogic 12.2, 14.1 and 15.1.\n\nApply Oracle's July 2026 patch now, then hunt for forged admin logins.", "creation_timestamp": "2026-07-25T15:37:22.463876Z"}, {"uuid": "6fb38450-ff66-4e9d-a02c-f76f14d53f93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Debajyoti0-0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-25 15:32:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTechnical analysis and Proof-of-Concept for CVE-2026-60206, a critical Oracle WebLogic Server SAML authentication bypass vulnerability.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-25T17:00:04.138896Z"}, {"uuid": "07379d1b-4c7a-442b-b24b-d0d95624eee8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/nPdorxgilRpeUK74owvb_SQJPx7ceIG4883buRWavnmG2X8", "content": "", "creation_timestamp": "2026-07-26T00:00:32.479624Z"}, {"uuid": "d765952d-7f7e-457b-b19e-d65bcb25784c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/rReBw0Q4jMbZrY7xLybdVTPGa0Ybeq3C-HMv0PXt8kiNSpo", "content": "", "creation_timestamp": "2026-07-26T00:00:14.251630Z"}, {"uuid": "44faff2f-37a2-42c3-b57b-157e575310cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95134", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60206\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Debajyoti0-0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-25 15:32:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nTechnical analysis and Proof-of-Concept for CVE-2026-60206, a critical Oracle WebLogic Server SAML authentication bypass vulnerability.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-26T00:00:38.360303Z"}, {"uuid": "ba1bc07e-afdf-42d8-980f-fc46e000acff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95022", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-60206-PoC-Exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-24 21:44:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udc7e CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework \u26a1Bash & Python versions. Features: --detect safe check, --exploit combo/unsigned/xsw/nameid/all, --shodan integration, --tor support, mass scanning, JSON/CSV/JSONL output, cookie validation. \ud83d\udee1\ufe0f CVSS 9.9 Critical - Use Ethically, Stay Legal. \ud83d\udd12\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-26T00:00:47.824021Z"}, {"uuid": "3b74f528-b05a-4477-b4c0-55049abc8c24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17649", "content": "\ud83d\udea8 CVE-2026-60206 \u2014 Oracle WebLogic SAML Authentication Bypass (Research PoC)\nA research repository demonstrating CVE-2026-60206, a critical SAML authentication bypass vulnerability affecting Oracle WebLogic Server. The project is intended for security research, vulnerability validation, and authorized security testing only.\n\n\ud83d\udccc GitHub\n\ud83d\udc49 https://github.com/imbas007/POC-CVE-2026-60206\n\n\u2728 Features\n\u2022 Detect affected Oracle WebLogic Server versions and exposed SAML endpoints.\n\u2022 Supports non-invasive vulnerability detection mode for validation.\n\u2022 Single-target and bulk target assessment workflows.\n\u2022 JSON report export for assessment results.\n\u2022 Multiple SAML validation and research modes for analyzing authentication handling.\n\u2022 Configurable proxy support for authorized testing environments.\n\u2022 Multi-threaded scanning support for large authorized environments.\n\u2022 Verbose logging for troubleshooting and research.\n\u2022 HTTPS/TLS verification controls for lab environments.\n\u2022 Python-based implementation for easy deployment and customization.\n\n\ud83d\udcbb Platform / Technologies\n\u2022 Python\n\u2022 Oracle WebLogic Server\n\u2022 SAML\n\u2022 XML\n\u2022 HTTPS\n\u2022 JSON\n\n\ud83c\udfaf Ideal For\n\u2022 Security Researchers\n\u2022 Penetration Testers\n\u2022 Red Team Operators\n\u2022 Blue Team Validation\n\u2022 Incident Response Teams\n\u2022 Enterprise Security Administrators\n\n\u26a0\ufe0f Note: This repository is intended for vulnerability research and validation in environments where you have explicit authorization. Organizations using affected Oracle WebLogic Server versions should apply Oracle's security updates and verify their deployments against the latest vendor guidance as soon as possible.\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-29T00:00:28.883038Z"}, {"uuid": "e24ed049-e92a-46cf-8f2d-ff5cc3006210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrrl5ssapn2y", "content": "\ud83d\udccc CVE-2026-60206 - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.... https://www.cyberhub.blog/cves/CVE-2026-60206", "creation_timestamp": "2026-07-29T09:07:07.870203Z"}, {"uuid": "50f6653d-a5bf-4fd1-9cd0-606ff8293469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "seen", "source": "https://gist.github.com/alon710/2ed2ec5aa094c7ca5a79e63f27744f8a", "content": "# CVE-2026-60206: CVE-2026-60206: Unauthenticated SAML Authentication Bypass in Oracle WebLogic Server\n\n> **CVSS Score:** 9.9\n> **Published:** 2026-07-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60206\n\n## Summary\nA critical vulnerability (CVE-2026-60206) in Oracle WebLogic Server allows unauthenticated or low-privileged attackers to bypass SAML authentication controls. This flaw stems from improper validation of XML signatures and parsing discrepancies in SAML assertions, allowing arbitrary administrative session creation.\n\n## TL;DR\nUnauthenticated SAML authentication bypass in Oracle WebLogic Server leading to administrative console access and remote code execution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306 / CWE-287\n- **Attack Vector**: Network\n- **CVSS v3.1**: 9.9\n- **EPSS Score**: 0.00541\n- **Impact**: Administrative Takeover / Remote Code Execution\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Oracle WebLogic Server 12.2.1.4.0\n- Oracle WebLogic Server 14.1.1.0.0\n- Oracle WebLogic Server 14.1.2.0.0\n- Oracle WebLogic Server 15.1.1.0.0\n- **WebLogic Server**: 12.2.1.4.0 (Fixed in: `Patch Applied`)\n- **WebLogic Server**: 14.1.1.0.0 (Fixed in: `Patch Applied`)\n- **WebLogic Server**: 14.1.2.0.0 (Fixed in: `Patch Applied`)\n- **WebLogic Server**: 15.1.1.0.0 (Fixed in: `Patch Applied`)\n\n## Mitigation\n\n- Apply Oracle July 2026 Critical Patch Update (CPU)\n- Restrict access to WebLogic admin console ports (7001/7002)\n- Implement Web Application Firewall (WAF) inspection rules for SAML XML payloads\n\n**Remediation Steps:**\n1. Download the patch corresponding to your WebLogic Server version from Oracle Support.\n2. Use the OPatch utility to apply the patch to the WebLogic Server home directory.\n3. Restart the WebLogic Server domains to apply the security changes.\n4. Verify the patch installation using 'opatch lsinventory'.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60206) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T10:01:40.198478Z"}, {"uuid": "47e9cc1a-6d51-42ec-a404-aba32cce9b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "creation_timestamp": "2026-09-05T01:00:04.912414Z"}, {"uuid": "09ca8587-d208-4623-8a06-5410151a6ed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-60206", "type": "published-proof-of-concept", "source": "Telegram/qPB9INxRUn7hqm5tMwZnjzgWjUliqqBv5hnORCgMkrQSFLQ", "content": "", "creation_timestamp": "2026-09-06T00:01:04.334674Z"}]}