Oracle WebLogic Server Proxy Plug-in: Access control vulnerability
Summary
Oracle WebLogic Server Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 is affected by a vulnerability that can be exploited over HTTP without authentication. An attacker with network access can create, modify or delete critical data and gain access to data handled by the plug-in, and the impact can extend to other products. The attack is rated as high complexity, and no exploit is known as of the sources reviewed.
Affected
- Oracle WebLogic Server Proxy Plug-in 12.2.1.4.0
- Oracle WebLogic Server Proxy Plug-in 14.1.1.0.0
- Oracle WebLogic Server Proxy Plug-in 14.1.2.0.0
Fixed in
Unknown. The vendor reference is Oracle's October 2026 Critical Patch Update (CPU), but the fixed builds could not be confirmed from the sources reviewed.
Workaround
Unknown. No vendor-documented workaround was found.
Exploitation
- No exploit available (VulDB, as of 21 Oct 2026)
- Not listed in CISA KEV (as of the sources reviewed)
- A different CVE in the same product family, CVE-2026-21962, is listed in CISA KEV because of active exploitation; this does not confirm exploitation of CVE-2026-87300
Our recommendation
- Inventory all WebLogic proxy plug-in instances (Apache, IIS, OHS) and their exact versions
- Apply the October 2026 Oracle CPU as a priority, starting with internet-facing instances
- Verify that the January 2026 CPU was also applied
- Restrict client access to the plug-in and to admin or console paths in front of WebLogic
- Review HTTP and application logs for unusual requests to the proxy tier
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- NVD record mirror (Vulners): CVE-2026-87300 vulners.com
- VulDB: CVE-2026-87300 vuldb.com
- Strix: CVE-2026-87300 www.strix.ai
- CISA: Known Exploited Vulnerabilities alert, 24 Aug 2026 (related CVE-2026-21962) www.cisa.gov
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 01:17.
Original description (NVD)
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.