Critical Alert 1 Active Exploit Detected Today

CVE-2026-64849 — MLflow Server-Side Request Forgery Vulnerability →

Powered by CVE Watchtower

×

CVE Watchtower

← Back to CVE List

CVE-2026-60696NVD

Vulnerability Summary

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Severity Level

CRITICAL(9.8)

Published Date

Aug 18, 2026

Last Modified

Aug 19, 2026

Exploitation Status

No confirmed exploitation yet

EPSS Score (30-Day)

0.52%Probability

Root Weakness (CWE)

CWE-306: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v3.1 Base Metrics

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

External References

https://www.oracle.com/security-alerts/cspuaug2026.html

🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

CVE-2026-64849CVSS 9.3
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior...
Admin intel📅 Updated: Aug 18, 2026
CVE-2026-71479CVSS 9.1
Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer...
Admin intel📅 Updated: Aug 18, 2026
CVE-2026-33824CVSS 9.8
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CISA KEV📅 Added to KEV: Aug 18, 2026
CVE-2026-55040CVSS 9.1
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
CISA KEV📅 Added to KEV: Aug 18, 2026
CVE-2026-59310CVSS 9.8
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may...
CISA KEV📅 Added to KEV: Aug 18, 2026
CVE-2025-62593CVSS 9.4
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool...
CISA KEV📅 Added to KEV: Aug 17, 2026
CVE-2026-59309CVSS 9.8
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to...
Admin intel📅 Updated: Aug 15, 2026
CVE-2026-65400CVSS 9.8
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS...
Admin intelCISA KEV📅 Added to KEV: Aug 18, 2026📅 Updated: Aug 15, 2026