EUVD-2026-46778
GHSA-2q8m-vp67-qw33
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N); Oracle scopes impact to integrity only, so C:N/I:H/A:N, matching the 7.5 base.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
AnalysisAI
Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
The affected component is the WebLogic Server Proxy Plug-in, a native module that runs inside third-party or Oracle HTTP Server front-ends (Apache, OHS) to reverse-proxy requests to a WebLogic Server back-end cluster. Because it terminates and forwards HTTP on behalf of WebLogic, flaws here sit directly in the request-handling path before application authentication is fully enforced, which is consistent with the vendor 'Authentication Bypass' tag. No CWE was assigned in the input, but the described effect - unauthorized creation, deletion or modification of data by an unauthenticated network client - points to a request routing/authorization-handling weakness in the plug-in rather than a memory-safety bug. Affected code ships in Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments of the WebLogic Server Proxy Plug-in and Oracle HTTP Server; the input provides the CPU advisory but not a discrete patched build string, so treat 'Patch available per vendor advisory' as the status and pull the exact patch/OPatch bundle for your platform from the CPU. Until patching, reduce exposure by restricting network reach to the proxy tier - front the plug-in with a WAF or reverse proxy that enforces authentication and filters anomalous proxied requests, and limit inbound HTTP to the plug-in to trusted networks; note this can break legitimate external access if the WebLogic app is meant to be public, so scope allow-lists carefully. Because the flaw is unauthenticated and network-reachable, avoid exposing the proxy directly to the internet where the back-end WebLogic application does not require it.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mod
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today