EUVD-2026-24377
GHSA-hhjq-6g7f-p34r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privileged WebLogic account
-
DeliveryReach Core component over HTTP
-
ExploitAbuse improper access control
-
ExecutionEscalate to full server control
-
ImpactCompromise hosted apps and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold high privileges on the target (CVSS PR:H) and network access to the Oracle WebLogic Server over HTTP; no user interaction is needed (UI:N) and attack complexity is low (AC:L). It applies to WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 Core component. The principal limiting factor is the high-privilege prerequisite - a low-privileged or fully unauthenticated remote attacker cannot exploit this as scored, which sharply narrows realistic attackers to those with existing admin/deployment-level access or a compromised privileged credential. Note the unresolved conflict: the 'Authentication Bypass' tag could imply weaker preconditions than PR:H suggests - confirm with Oracle. |
| Impact | Signals here are consistent in pointing to a serious-impact but hard-to-reach issue. Technical impact is 'total' (C:H/I:H/A:H, SSVC total) - a successful attack means full server takeover. However, exploitation is gated by PR:H (high privileges already required) and AC:L over the network, and CISA SSVC lists Exploitation: none and Automatable: no. EPSS is only 0.04% (12th percentile), and the CVE is not in CISA KEV, so widespread or automated exploitation is not currently expected. There is a data conflict to flag: the 'Authentication Bypass' tag implies circumventing authentication, yet the CVSS vector requires PR:H (an authenticated, privileged actor) - verify with Oracle which is authoritative, as it materially changes exploitability. Net: a real 'patch it in the normal Oracle CPU cycle' issue for internet-facing or multi-tenant WebLogic, not an emergency drop-everything item absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker who has already obtained a high-privileged WebLogic account (for example a compromised administrative or deployment credential, or an insider) sends crafted HTTP requests to the Core component to abuse the access-control weakness and pivot to full control of the server. No public exploit code is identified at time of analysis, and low attack complexity means that once the privilege prerequisite is met the attack is reliable, leading to complete takeover of the WebLogic instance and any applications and data it hosts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle ships this fix as part of the quarterly CPU rather than as a standalone tagged release, so apply the CPU patch appropriate to your 12.2.1.4.0 or 14.1.1.0.0 installation (Patch available per vendor advisory - an independently confirmed standalone fix version is not published in the input). Until the CPU is applied, reduce exposure by restricting HTTP/administrative access to WebLogic to trusted management networks and VPNs, tightening the accounts that hold high privileges (since PR:H is required), and enforcing least-privilege on WebLogic admin and deployment roles to shrink the pool of actors who could exploit this; note these controls limit access but do not remediate the underlying improper access control. Monitor admin-console and management-endpoint activity for anomalous privileged actions as a detective compensating control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebLogic Server is a widely deployed Java EE application server within the Oracle Fusion Middleware stack, commonly used to host enterprise web applications and integration tiers exposed over HTTP/T3. The flaw resides in the Core component and is classed as CWE-284 (Improper Access Control), meaning an authorization or access-control check is missing or incorrectly enforced, allowing an actor who already holds elevated privileges to escalate to complete control of the server. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_weblogic_server, spanning the 12.2.1.4.0 and 14.1.1.0.0 release trains. The 'Authentication Bypass' tag suggests the root cause may let an already-authenticated principal bypass an intended access boundary, though the CVSS PR:H metric indicates meaningful privileges are still a prerequisite.
Know when Oracle Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector with low complexity, but description explicitly requires a high-privileged attacker (PR:H); total takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are vulnerable to a critical flaw allowing high-privileged administrators to completely compromise the server. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis. Organizations running these versions face potential total loss of data confidentiality, system integrity, and service availability if a privileged account is compromised, necessitating immediate action to reduce exposure.
Restrict HTTP network access to WebLogic administrative interfaces to authorized administrative networks only; enforce multi-factor authentication for all privileged account access; implement comprehensive audit logging and real-time monitoring of administrative activities on affected instances; minimize the number of privileged accounts with administrative rights through privilege management; maintain continuous subscription to Oracle security advisories to enable rapid patch deployment upon vendor release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Weblogic Server
View allFull server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, net
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated atta
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers s
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core co
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker f
Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote att
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker
Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated at
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers re
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 all
Exploit-DB