EUVD-2026-46779
GHSA-h7j7-j4hp-pqf3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Unauthenticated network HTTP access with no user interaction (AV:N/AC:L/PR:N/UI:N), authentication bypass yields full data read/modify (C:H/I:H) with no availability impact, and cross-system reach gives scope change (S:C).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthenticated remote compromise of the Oracle WebLogic Server Proxy Plug-in (version 15.1.1.0.0), a module that fronts WebLogic behind third-party web servers such as Apache HTTP Server and Oracle HTTP Server, allowing a network attacker to read and modify critical data with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the flaw crosses a trust boundary (scope change), meaning exploitation of the plug-in significantly impacts additional connected products. Vendor tagging identifies it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability warrants urgent patching.
Technical ContextAI
The affected component is the WebLogic Server Proxy Plug-in for Third-Party Web Servers - a native module (mod_wl / mod_wl_ohs style connector) deployed inside a front-end web server (Oracle HTTP Server or Apache) that proxies HTTP requests to back-end WebLogic managed servers. Because the plug-in terminates and forwards requests on behalf of clients, a defect in how it validates or authenticates those requests can let an attacker bypass authentication controls (vendor tag: 'Authentication Bypass') and reach protected back-end resources. No CWE was assigned by NVD, but the behavior class is authentication-bypass-by-spoofing/improper-authentication (roughly CWE-287/CWE-290). The scope change (S:C) reflects that the vulnerable plug-in sits in front of, and grants access to, separate WebLogic and other Fusion Middleware systems, so compromise propagates beyond the plug-in's own security authority.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; no standalone fixed build number was provided in the input, so obtain the exact patch bundle for WebLogic Server Proxy Plug-in 15.1.1.0.0 and the corresponding Oracle HTTP Server releases (12.2.1.4.0, 14.1.2.0.0) from that CPU. Because this is an unauthenticated, scope-changing authentication bypass, treat patching as emergency and prioritize any internet-facing proxy tiers first. Until patched, compensating controls include restricting network access to the proxy/OHS listener with firewall or WAF rules so only trusted upstream load balancers can reach it (trade-off: does not stop attackers already inside the network segment), enforcing authentication at the front-end web server or an upstream reverse proxy rather than relying on the plug-in, and, where the third-party proxy path is not required, disabling or unloading the WebLogic proxy module to remove the exposure (trade-off: breaks proxied access to back-end WebLogic apps). Monitor OHS/proxy access logs for anomalous requests that reach back-end resources without expected authentication.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mod
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today