Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Remote Access and Data Exposure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the Centralized Thirdparty Jars component of Oracle WebLogic Server and permits an unauthenticated attacker to initiate a network request via HTTP. When successfully exploited, the attacker can obtain unauthorized access to critical data or, in some cases, full access to all data exposed by the WebLogic Server. The weakness is classified under confidential data impact with no impact on integrity or availability.

Affected Systems

The affected product is Oracle WebLogic Server. The vulnerable versions are Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Risk and Exploitability

The CVSS 3.1 score of 5.9 indicates moderate severity with a high access complexity and no required privileges. The exploit requires only network access over HTTP and no authentication. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Given the network-based attack surface and potential for data exposure, the risk to systems left unpatched remains significant.

Generated by OpenCVE AI on October 21, 2026 at 05:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle WebLogic Server patch that addresses the Centralized Thirdparty Jars vulnerability.
  • Restrict inbound HTTP traffic to the WebLogic Server using firewall rules or place the server behind a VPN to limit exposure to trusted networks.
  • If a patch is not immediately available, disable or block the publicly exposed HTTP interface to reduce attack surface.

Generated by OpenCVE AI on October 21, 2026 at 05:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle weblogic Server
CPEs cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle weblogic Server
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Weblogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:17.925Z

Reserved: 2026-09-28T15:40:09.489Z

Link: CVE-2026-101515

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:00.743

Modified: 2026-10-20T22:18:00.743

Link: CVE-2026-101515

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T01:30:16Z

Weaknesses

No weakness.