EUVD-2026-46706
GHSA-m45f-j92r-qrj9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed WebLogic HTTP port
-
DeliverySend crafted request to Core component
-
ExploitBypass authentication / trigger flaw
-
ExecutionExecute code on server
-
ImpactFull server takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against supported/default deployments of Oracle WebLogic Server (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), per AV:N/AC:L/PR:N/UI:N. The only meaningful limiting factor is network reachability of the WebLogic HTTP interface: servers whose management/application ports are isolated behind firewalls, VPNs or internal-only segments are not exposed to opportunistic internet attackers, and instances not running one of the four listed supported versions fall outside the stated affected set. No authentication, no configuration toggle and no user interaction is required to trigger the flaw. |
| Impact | All CVSS signals point to maximum severity and priority: AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated, low-complexity attack with no user interaction, and C:H/I:H/A:H combined with the 'takeover' language indicates full server compromise (9.8 Critical). No EPSS score, SSVC decision, KEV listing or POC was supplied in the intelligence, so exploitation-probability and automatability signals are UNKNOWN rather than low - absence of these data points must not be read as reduced risk. There is no conflict between the CVSS vector and the description; both agree on remote unauthenticated network exploitation. Given WebLogic's track record (multiple prior 9.8 deserialization bugs such as CVE-2020-14882/14750 and CVE-2019-2725 were mass-exploited within days), this should be treated as a top-tier, patch-immediately priority even though active exploitation is not yet confirmed. |
| Exploit ScenarioDerived | An attacker who can reach the WebLogic HTTP port from the network sends a single crafted request to the vulnerable Core component endpoint, requiring no credentials and no victim interaction, and gains code execution or administrative control of the server. This yields full takeover - data theft, tampering and service disruption - and could be scripted for internet-wide scanning; no public proof-of-concept has been identified at time of analysis, but the low complexity makes reliable exploitation plausible once technical details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.
RemediationAI
Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the exact patched build for each of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 must be taken from that CPU matrix, as no discrete fixed version string was provided in this intelligence and none should be invented. Until patching completes, reduce exposure by restricting network access to WebLogic HTTP and administration ports (default 7001/7002) so they are not reachable from untrusted networks, and place the server behind a reverse proxy or WAF that filters anomalous requests to the Core/console paths; because prior WebLogic takeover bugs abused deserialization endpoints, consider disabling or firewalling the T3/IIOP and remote console interfaces if not required, accepting the trade-off that remote administration and some clustering functions may break. These are compensating controls only - the CPU patch is the sole complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebLogic Server is a Java EE application server within the Oracle Fusion Middleware stack, widely deployed to host enterprise Java web applications and services. The vulnerability resides in the 'Core' component and is reachable over HTTP, the same protocol WebLogic exposes for its management, console and application-serving interfaces. No CWE was assigned in the source data, so the precise root-cause class (historically WebLogic 'takeover' bugs have stemmed from insecure deserialization of untrusted data - CWE-502 - in T3/IIOP or HTTP handlers, or from authentication-bypass path traversal) cannot be confirmed from the provided intelligence. The single CPE, cpe:2.3:a:oracle_corporation:oracle_weblogic_server:*:*:*:*:*:*:*:*, confirms the affected product but does not itself constrain versions; the affected version list comes from the Oracle advisory text.
Know when Oracle Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms remote unauthenticated HTTP exploitation with low complexity and no interaction resulting in full server takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebLogic Server instances running supported versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to complete takeover by unauthenticated attackers with no available patches, creating significant operational risk across enterprise application infrastructure. Leadership should treat this as a critical remediation priority given WebLogic's centrality to business-critical systems and the near-certain emergence of public exploitation tools.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict network segmentation restricting HTTP/HTTPS access to WebLogic servers from trusted administrative subnets only; (2) Deploy Web Application Firewall with rules to block exploitation attempts targeting Core component endpoints; (3) Enable comprehensive WebLogic logging and configure real-time alerting on suspicious HTTP request patterns; (4) Disable non-critical WebLogic services until patches become available; (5) Deploy intrusion prevention system (IPS) rules to monitor and block known WebLogic exploitation signatures; (6) Implement IP whitelisting on WebLogic administrative interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Weblogic Server
View allFull server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, net
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated atta
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers s
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker f
Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote att
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker
Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated at
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers re
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 all
Server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged, remote attacker wi
Exploit-DB