Oracle WebLogic Server
CVE-2025-61764
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N); only partial confidentiality read impact, so C:L with I:N/A:N and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthenticated information disclosure in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 lets a remote attacker who can reach the HTTP listener read a subset of data that the server can access, with the Core component of Oracle Fusion Middleware as the affected surface and a CVSS 3.1 base score of 5.3 (C:L, no integrity or availability impact). Exploitation requires no credentials, no user interaction and low complexity (AV:N/AC:L/PR:N/UI:N), but the payoff is bounded to partial confidentiality loss. No public exploit code has been identified at time of analysis and EPSS is 0.26% (17th percentile), so signals point to a real but moderate-priority issue rather than a critical emergency.
Technical ContextAI
The issue sits in the Core component of Oracle WebLogic Server, Oracle's Java EE/Jakarta EE application server, and is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - a class covering code paths that return more data than the caller is entitled to see rather than a memory-safety or injection flaw. Per the supplied CPE data the impacted builds are oracle:weblogic_server 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0; Core covers the server's foundational runtime - servlet/container request handling, the HTTP and T3/T3S listeners, and internal admin services - rather than a discrete add-on such as the console or WLS Security. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N describes an unauthenticated network request with no user interaction and low complexity, where impact is capped at partial confidentiality loss and the scope stays unchanged. Oracle does not disclose the underlying code-level root cause or the specific servlet/endpoint in the CPU advisory, so the exact request pattern that triggers the over-exposure is not confirmed from available data; what is confirmed is the information-disclosure class and the unauthenticated, network-reachable exploitation model.
RemediationAI
Patch available per vendor advisory: Oracle addressed CVE-2025-61764 in its Critical Patch Update for October 2025 (https://www.oracle.com/security-alerts/cpuoct2025.html), which is the authoritative source for the exact patched build numbers covering the 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 streams - an exact fixed version string is not independently confirmed in the provided data, so verify the CPU's stated minimum patch level before upgrading, and note that Oracle CPUs require a valid support contract and usually a rolling restart of managed servers. Because the flaw is reachable unauthenticated over HTTP with only network reachability required, the highest-value compensating control is to restrict access to the WebLogic HTTP listener: block inbound 7001/7002 (and any custom HTTP ports) at the firewall, security group or load balancer so that only trusted clients - administrators, health checkers and upstream application servers - can connect, accepting the trade-off that legitimate browser or API access from untrusted networks breaks. Where external exposure cannot be avoided, front the listener with a WAF or reverse proxy and alert on anomalous requests to server-internal paths, recognizing this is detection-oriented rather than a hard stop. As general attack-surface reduction, retire unused default management contexts and sample applications on internet-facing instances, since that can break management workflows and integrations that depend on them, and monitor WebLogic audit and HTTP access logs for unauthorized reads until the CPU patch is applied.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today