EUVD-2026-46779
GHSA-h7j7-j4hp-pqf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach front-end proxy over HTTP
-
DeliverySend crafted request bypassing authentication
-
ExploitProxy forwards to protected back-end
-
ExecutionRead or modify critical WebLogic data
-
ImpactPivot across scope to connected Fusion Middleware systems
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be running the Oracle WebLogic Server Proxy Plug-in 15.1.1.0.0 configured to front WebLogic behind a third-party or Oracle HTTP Server, with that proxy endpoint reachable by the attacker over HTTP - that specific deployment mode (proxy plug-in enabled and network-exposed) is the precondition. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, there are no special conditions beyond network HTTP reachability: exploitation is unauthenticated, requires no user interaction, and works against affected default plug-in configurations. Limiting factors are that only environments actually deploying the proxy plug-in (not direct-to-WebLogic setups) are exposed, only the named versions are affected, and network segmentation or upstream authentication in front of the proxy would constrain who can reach the vulnerable listener. |
| Impact | This is a genuine top-priority issue, not an inflated high-CVSS artifact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N is internally consistent with the description: network-reachable over HTTP, low complexity, no privileges, no user interaction, with full confidentiality and integrity loss and a scope change - yielding the maximum score of 10.0. The absence of an availability impact (A:N) is consistent with a data-access/authentication-bypass flaw rather than a crash or DoS. No EPSS score was provided and the CVE is not in CISA KEV, and no public POC is referenced, so real-world exploitation is currently unproven - the risk signal here is driven by exploitability and impact, not by observed activity. The main conflicting data point is scope: EUVD lists Oracle HTTP Server 12.2.1.4.0/14.1.2.0.0 as affected while NVD names only the Proxy Plug-in 15.1.1.0.0, so defenders should confirm exactly which front-end deployment is vulnerable via the Oracle July 2026 CPU. |
| Exploit ScenarioDerived | An attacker who can reach the front-end web server over HTTP sends a crafted request that the WebLogic Proxy Plug-in mishandles, bypassing authentication and being forwarded to protected back-end WebLogic resources. Because no credentials, user interaction, or complex conditions are needed (AV:N/AC:L/PR:N/UI:N), the attacker then reads or tampers with critical application data, and the scope change lets the impact extend to other Fusion Middleware systems behind the proxy. No public POC is referenced at time of analysis, but the low complexity makes independent exploit development plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated remote compromise of the Oracle WebLogic Server Proxy Plug-in (version 15.1.1.0.0), a module that fronts WebLogic behind third-party web servers such as Apache HTTP Server and Oracle HTTP Server, allowing a network attacker to read and modify critical data with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the flaw crosses a trust boundary (scope change), meaning exploitation of the plug-in significantly impacts additional connected products. Vendor tagging identifies it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability warrants urgent patching.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; no standalone fixed build number was provided in the input, so obtain the exact patch bundle for WebLogic Server Proxy Plug-in 15.1.1.0.0 and the corresponding Oracle HTTP Server releases (12.2.1.4.0, 14.1.2.0.0) from that CPU. Because this is an unauthenticated, scope-changing authentication bypass, treat patching as emergency and prioritize any internet-facing proxy tiers first. Until patched, compensating controls include restricting network access to the proxy/OHS listener with firewall or WAF rules so only trusted upstream load balancers can reach it (trade-off: does not stop attackers already inside the network segment), enforcing authentication at the front-end web server or an upstream reverse proxy rather than relying on the plug-in, and, where the third-party proxy path is not required, disabling or unloading the WebLogic proxy module to remove the exposure (trade-off: breaks proxied access to back-end WebLogic apps). Monitor OHS/proxy access logs for anomalous requests that reach back-end resources without expected authentication.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WebLogic Server Proxy Plug-in for Third-Party Web Servers - a native module (mod_wl / mod_wl_ohs style connector) deployed inside a front-end web server (Oracle HTTP Server or Apache) that proxies HTTP requests to back-end WebLogic managed servers. Because the plug-in terminates and forwards requests on behalf of clients, a defect in how it validates or authenticates those requests can let an attacker bypass authentication controls (vendor tag: 'Authentication Bypass') and reach protected back-end resources. No CWE was assigned by NVD, but the behavior class is authentication-bypass-by-spoofing/improper-authentication (roughly CWE-287/CWE-290). The scope change (S:C) reflects that the vulnerable plug-in sits in front of, and grants access to, separate WebLogic and other Fusion Middleware systems, so compromise propagates beyond the plug-in's own security authority.
Know when Http Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Unauthenticated network HTTP access with no user interaction (AV:N/AC:L/PR:N/UI:N), authentication bypass yields full data read/modify (C:H/I:H) with no availability impact, and cross-system reach gives scope change (S:C).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
Oracle WebLogic Server Proxy Plug-in version 15.1.1.0.0 contains a critical unauthenticated vulnerability (CVSS 10.0) enabling network attackers to read and modify sensitive data without credentials, directly compromising backend WebLogic systems and downstream connected applications. Organizations operating this proxy component face immediate risk to data confidentiality and system integrity across their infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation restricting proxy access to trusted internal subnets only; deploy Web Application Firewall rules to monitor and block exploitation attempts targeting the proxy module; enforce upstream reverse-proxy authentication to require credentials before reaching the vulnerable component; enable enhanced audit logging of all proxy-module transactions; restrict data flows through the vulnerable proxy to non-critical assets only until patched version is available from Oracle.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
Exploit-DB