Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in the core component of Oracle WebLogic Server allows an unauthenticated attacker who can reach the server over HTTP to compromise the system. The vulnerability, caused by weaknesses in authentication (CWE-287) and lack of privilege separation (CWE-306), enables the attacker to execute arbitrary code on the server, leading to a full takeover. This poses severe confidentiality, integrity, and availability risks to any organization running the affected software.

Affected Systems

Oracle WebLogic Server, versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

Risk and Exploitability

The CVSS base score is 9.8, indicating critical severity. The EPSS score is < 1%, indicating very low exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is a simple network‑based HTTP request to a vulnerable endpoint, requiring no authentication, and can be executed from any host with network connectivity to the server.

Generated by OpenCVE AI on October 22, 2026 at 07:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle patch bundle or upgrade to an unaffected version as specified in the Oracle CPU Oct 2026 advisory.
  • Restrict external access to the WebLogic HTTP port by using firewall rules or network segmentation so that only trusted hosts can reach the server.
  • Monitor WebLogic logs for anomalous HTTP requests or signs of exploitation and verify configuration integrity after patching.

Generated by OpenCVE AI on October 22, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle WebLogic Server

Wed, 21 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle WebLogic Server via HTTP
Weaknesses CWE-284
CWE-94

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution Vulnerability in Oracle WebLogic Server via HTTP
Weaknesses CWE-284
CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle weblogic Server
CPEs cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle weblogic Server
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Weblogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T03:56:04.150Z

Reserved: 2026-09-14T22:10:16.627Z

Link: CVE-2026-91323

cve-icon Vulnrichment

Updated: 2026-10-21T10:53:49.563Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:34.323

Modified: 2026-11-10T14:44:06.587

Link: CVE-2026-91323

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:30:11Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function