Oracle WebLogic Server Proxy Plug-in: Unauthorized access to data
Summary
The Oracle WebLogic Server Proxy Plug-in, a component of Oracle Fusion Middleware that runs in front-end web servers and forwards requests to WebLogic application servers, is affected. An unauthenticated attacker with HTTP network access can, according to the CNA record, gain unauthorized access to critical data and create, modify or delete data. Oracle rates the attack complexity as high, and the flaw has a scope change, so impact can extend beyond the proxy. NVD analysis was still pending at the time of research.
Affected
- Oracle WebLogic Server Proxy Plug-in 12.2.1.4.0
- Oracle WebLogic Server Proxy Plug-in 14.1.1.0.0
- Oracle WebLogic Server Proxy Plug-in 14.1.2.0.0
Fixed in
Unknown. Oracle lists the fix in the October 2026 Critical Patch Update. Check the Patch Availability table in the Oracle advisory for the exact patch of each version line.
Workaround
- No vendor workaround found for this CVE.
- Limit access to the proxy to trusted IP addresses and keep it off the public internet where possible (general guidance, not confirmed by Oracle for this CVE).
- Isolate proxy systems from backend WebLogic clusters until patched (general guidance).
Exploitation
- No known exploitation of this CVE. CISA SSVC lists exploitation as none.
- No public proof-of-concept found for this CVE.
- A related CVE in the same plug-in family, CVE-2026-21962, is listed in CISA KEV after exploitation.
Our recommendation
- Inventory all Apache and IIS installations with the WebLogic Server Proxy Plug-in, including forgotten or third-party deployments.
- Apply the October 2026 Critical Patch Update or a later cumulative patch for each affected version line.
- Verify that the January 2026 CPU or later is applied, given the KEV listing of CVE-2026-21962.
- Restrict access to the proxy and monitor it for unusual HTTP requests.
- Re-check NVD and the CISA KEV catalog, since analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- Vulners: CVE-2026-83379 record vulners.com
- Vulners: Oracle October 2026 CPU mirror vulners.com
- Strix: CVE-2026-83379 www.strix.ai
- VulDB: CVE-2026-83379 (CVSS discrepancy) vuldb.com
- CISA: KEV addition of related CVE-2026-21962 www.cisa.gov
- Waratek: October 2026 CPU overview waratek.com
- NetSPI: Oracle WebLogic proxy plug-in overview www.netspi.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:18.
Original description (NVD)
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.