EUVD-2026-61393
GHSA-3j68-w34w-39gr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easy, remote, unauthenticated T3/IIOP exploitation with full server takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the WebLogic Server's T3 (default TCP 7001/7002) or IIOP listener - these are the exact protocols named by Oracle as the attack path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This should be treated as a top-priority, patch-now issue: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes trivial, remote, unauthenticated exploitation yielding total compromise, and Oracle itself labels it 'easily exploitable' - so even a mid-sized municipal IT team in gliwice running an internet-reachable WebLogic instance should treat this as urgent and assume exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes from the Oracle August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) to each affected release; Oracle delivers these as CPU patch bundles rather than a single named version, so select the patch corresponding to your exact installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) - no standalone fix version string was provided in the input to cite verbatim. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle WebLogic installations and identify instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, then restrict network access to T3 and IIOP ports (default 7001, 7002, 7003, 7004) at the firewall level to only trusted internal sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today