Oracle WebLogic Server: Unauthenticated compromise via HTTP in Core component
Summary
Oracle WebLogic Server in the Core component of Oracle Fusion Middleware contains a critical flaw (CVSS 9.8) in four supported branches. An unauthenticated attacker with network access via HTTP can take over the server without user interaction. The CVE record describes a full loss of confidentiality, integrity and availability, so applications and data hosted on the server are also at risk.
Affected
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
Fixed in
Unknown. Check the patch availability table in the Oracle Critical Patch Update October 2026 for the fixed patch of each branch.
Workaround
Vendor workaround: Unknown. No vendor workaround was found in the sources reviewed.
- Interim measure (not from a vendor source): restrict which networks can reach the WebLogic HTTP listener and its admin and console paths, and remove the server from the internet where possible. Closing ports reduces exposure but is not a fix.
Exploitation
- No evidence of exploitation in the wild found as of 30 Oct 2026.
- Not listed in the CISA KEV catalog.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept found.
Our recommendation
- Identify all WebLogic instances and their versions, including those bundled with third-party products.
- Apply the patch for each affected branch from the Oracle October 2026 CPU advisory.
- Check CVE-2026-83399 (T3/IIOP, CVSS 9.8, same CPU) separately and patch it at the same time.
- Until patched, restrict HTTP access from untrusted networks and review logs for unusual requests to WebLogic HTTP endpoints.
- Treat internet-facing or partner-facing servers as urgent and internal servers as high priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- CVE record mirror (Vulners) vulners.com
- OpenCVE record app.opencve.io
- Strix CVE record www.strix.ai
- Brandefense: Oracle October 2026 CPU brandefense.io
- Waratek: Oracle October 2026 CPU waratek.com
- VulDB entry (conflicting CVSS and CWE data) vuldb.com
- Dev.to: Oracle October CPU and T3 exposure dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:12.
Original description (NVD)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.