What is the CVSS score of CVE-2025-61752?

CVE-2025-61752 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2025-61752?

Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0 are affected by a high-severity unauthenticated denial-of-service condition that can hang or crash HTTP/2 listeners, potentially disrupting business…

How to fix or mitigate CVE-2025-61752?

Within 24 hours: Confirm whether Oracle WebLogic Server 14.1.1.0.0 or 14.1.2.0.0 is deployed and which HTTP/2-capable listeners are reachable from untrusted networks; restrict access via firewall or security group rules and consider temporarily disabling HTTP/2 on affected listeners if business operations permit. Within 7 days: Apply compensating controls such as WAF rules, rate limiting, connection limits, and network segmentation; enable enhanced availability monitoring and crash detection; verify the vendor advisory status and test any interim Oracle guidance in a non-production environment. Within 30 days: Track Oracle for a vendor-released patch, schedule emergency change windows to deploy it once available, and reassess whether the affected WebLogic versions can be upgraded, migrated, or isolated behind hardened proxies; update incident response plans for repeated outage scenarios.

Oracle WebLogic Server CVE-2025-61752

HIGH

Missing Authentication for Critical Function (CWE-306)

2025-10-21 secalert_us@oracle.com

Authentication Bypass Oracle Weblogic Server

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated low-complexity HTTP/2 network attack (AV:N/AC:L/PR:N/UI:N) causing complete DoS with no confidentiality or integrity impact (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 15:52 vuln.today

CVE Published

Oct 21, 2025 - 20:20 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Unauthenticated denial of service in Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0 allows a remote attacker with network access over HTTP/2 to hang or repeatedly crash the server through the Core component, yielding a complete denial of service with no confidentiality or integrity impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack requires only that an HTTP/2-capable listener be reachable; per the assessed vector, no authentication, privileges, or user interaction are needed. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), suggesting exploitation is not currently widespread, though the low attack complexity keeps it a realistic availability risk for internet-facing or broadly reachable instances.

Technical ContextAI

The flaw resides in the Core component of Oracle WebLogic Server, Oracle Fusion Middleware's Java EE application server, and manifests when requests are processed over the HTTP/2 protocol. It is classified as CWE-306 (Missing Authentication for Critical Function): a critical server function reachable through the HTTP/2 path can be invoked without the authentication that should gate it, and the resulting processing state leads to a hang or repeated crash of the server. The CPE data confirms the affected builds are oracle:weblogic_server 14.1.1.0.0 and 14.1.2.0.0. Because the assessed CVSS vector is S:U and C:N/I:N/A:H, the defect is confined to availability rather than enabling code execution, privilege escalation, or data disclosure - the HTTP/2 handling path is the attack surface, and instances that do not expose HTTP/2 (or that are not network-reachable) are not exposed to the vector as assessed.

RemediationAI

Apply the Oracle Critical Patch Update for October 2025 (https://www.oracle.com/security-alerts/cpuoct2025.html), which addresses CVE-2025-61752 for WebLogic Server 14.1.1.0.0 and 14.1.2.0.0 - this is the primary and recommended fix. Where immediate patching is not possible, reduce exposure by disabling or not enabling HTTP/2 on WebLogic listeners so the affected code path is unreachable from untrusted networks, accepting the performance trade-off for clients that rely on HTTP/2 multiplexing; alternatively, restrict network access to the HTTP/2 listener with firewall or security-group rules so only trusted clients can reach it. Front the deployment with a reverse proxy or WAF that caps HTTP/2 request rates and connection concurrency to blunt repeated-crash attempts, though this is a mitigation rather than a fix and may not fully prevent the hang. Monitor for abnormal HTTP/2 connection patterns and plan the CPU patch as the definitive remediation.