Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Remote Access and Data Exposure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Centralized Thirdparty Jars component of Oracle WebLogic Server and permits an unauthenticated attacker to initiate a network request via HTTP. When successfully exploited, the attacker can obtain unauthorized access to critical data or, in some cases, full access to all data exposed by the WebLogic Server. The weakness is classified under confidential data impact with no impact on integrity or availability.

Affected Systems

The affected product is Oracle WebLogic Server. The vulnerable versions are Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Risk and Exploitability

The CVSS 3.1 score of 5.9 indicates moderate severity with a high access complexity and no required privileges. The exploit requires only network access over HTTP and no authentication. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Given the network-based attack surface and potential for data exposure, the risk to systems left unpatched remains significant.

Generated by OpenCVE AI on November 6, 2026 at 20:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle WebLogic Server patch that addresses the Centralized Thirdparty Jars vulnerability.
  • Restrict inbound HTTP traffic to the WebLogic Server using firewall rules or place the server behind a VPN to limit exposure to trusted networks.
  • If a patch is not immediately available, disable or block the publicly exposed HTTP interface to reduce attack surface.

Generated by OpenCVE AI on November 6, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exposes Data via WebLogic Server Thirdparty Jars

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Thu, 05 Nov 2026 16:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exposes Data via WebLogic Server Thirdparty Jars
Weaknesses CWE-269
CWE-285

Thu, 05 Nov 2026 15:15:00 +0000

Type Values Removed Values Added
Title Oracle WebLogic Server Unauthenticated Remote Access via Centralized Thirdparty Jars
Weaknesses CWE-200
CWE-284

Thu, 05 Nov 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 06:00:00 +0000

Type Values Removed Values Added
Title Oracle WebLogic Server Unauthenticated Remote Access via Centralized Thirdparty Jars
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle weblogic Server
CPEs cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle weblogic Server
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Weblogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T18:59:22.414Z

Reserved: 2026-09-28T15:40:09.489Z

Link: CVE-2026-101515

cve-icon Vulnrichment

Updated: 2026-11-06T18:58:32.422Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:18:00.743

Modified: 2026-11-06T19:17:04.290

Link: CVE-2026-101515

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T20:30:10Z

Weaknesses