Oracle WebLogic Server: Missing authentication in Core component
Summary
Oracle WebLogic Server in the Core component, part of Oracle Fusion Middleware, can be attacked over HTTP without a login or user interaction. The CVE record describes unauthorized creation, deletion or modification of data accessible to WebLogic, and CVSS 9.1 rates the impact on confidentiality and integrity as high. Public sources describe no known exploitation so far, but internet-exposed instances carry the highest risk.
Affected
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
Fixed in
- Fixed in Oracle's October 2026 Critical Patch Update (released 20 October 2026).
- Exact patch level per affected branch: Unknown. Check the Patch Availability Document linked in the Oracle advisory.
Workaround
- Vendor-documented workaround: Unknown.
- Until patched, restrict network access to WebLogic listeners and admin interfaces to internal networks or VPN (our recommendation, not from the vendor).
Exploitation
- No evidence of exploitation found.
- Not listed in the CISA KEV catalog (per Strix record).
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No public proof-of-concept exploit found in our searches.
Our recommendation
- Inventory all WebLogic instances, versions and internet exposure.
- Patch affected branches to the October 2026 CPU using the patch level from Oracle's advisory, prioritising internet-facing instances.
- Restrict admin and T3/IIOP access to internal networks or VPN.
- Review HTTP logs for unexpected requests to WebLogic since 20 October 2026.
- Re-check CISA KEV and NVD, as NVD analysis was still pending at research time.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert: October 2026 CPU www.oracle.com
- NVD/Vulners record CVE-2026-87302 vulners.com
- Strix CVE-2026-87302 www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
- HivePro: Oracle October 2026 CPU www.hivepro.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:45.
Original description (NVD)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.