EUVD-2026-79509
GHSA-cmxr-46w4-7j9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed T3/IIOP listener (port 7001)
-
DeliverySend crafted unauthenticated T3/IIOP request
-
ExploitBypass authentication / trigger core flaw
-
ExecutionExecute arbitrary code on server
-
ImpactFull WebLogic takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the WebLogic server's T3 and/or IIOP listener (by default the same port as the admin/managed server HTTP port, typically 7001), which is enabled by default in standard deployments. No authentication and no user interaction are needed (PR:N/UI:N). The primary limiting factor is network exposure of the T3/IIOP protocol: environments that firewall or disable T3/IIOP, or restrict it via connection filters (weblogic.security.net.ConnectionFilterImpl), materially reduce reachability. Affected only on WebLogic 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. |
| Impact | This is a genuine high-priority vulnerability, not a CVSS-inflated one. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) is internally consistent with the description: unauthenticated, low-complexity, network-reachable exploitation via the T3 and IIOP protocols resulting in full server takeover (C:H/I:H/A:H). T3/IIOP are the native WebLogic remoting protocols and are typically enabled by default and frequently exposed, which supports AC:L and PR:N. The counterbalancing signals are the absence of external threat-intel corroboration in the provided data: no EPSS score, no CISA KEV listing, and no public POC are present at time of analysis, so exploitation is currently 'no public exploit identified.' Historically, however, WebLogic T3/IIOP flaws (e.g., the CVE-2020-2551/2555/14882 lineage) are rapidly weaponized and mass-scanned once patches ship, so the low current signal likely reflects recency (Oracle September 2026 CPU) rather than low real-world risk. Note that the CWE assigned is CWE-287 (Improper Authentication) and the tag is 'Authentication Bypass,' whereas WebLogic T3/IIOP 'takeover' issues are usually deserialization-driven RCE (CWE-502); the exact mechanism is not disclosed in Oracle's terse CPU entry - verify with the vendor advisory. |
| Exploit ScenarioDerived | An attacker with network reachability to a WebLogic server's T3 or IIOP listener (commonly the same port as HTTP, 7001) sends a crafted request over T3/IIOP without any credentials, exploiting the flaw to bypass authentication and execute code, resulting in complete takeover of the server. No user interaction or prior access is required. No public exploit code is identified in the provided data, but this protocol class is historically fast to be weaponized after Oracle CPU disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
RemediationAI
Patch availability is per the vendor advisory: Oracle's security alert for this issue (https://www.oracle.com/security-alerts/cspusep2026.html) is the authoritative source for the fixed release, and exact fix versions were not specified in the supplied intelligence data, so confirm the corrected build for your 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 installation there and upgrade before exposing the server. Where immediate patching is not possible, the highest-value compensating control is to cut reachability of T3 and IIOP: install a connection filter (weblogic.security.net.ConnectionFilterImpl) with an allowlist of trusted administration and managed-server addresses and deny everything else, accepting that a misconfigured filter can lock out legitimate WLST/JMX and cluster traffic, so stage the rules and restart listeners carefully; alternatively block the listener port (by default 7001) at the host or network firewall and permit only known management hosts, which breaks remote WLST/JMX and administration console access until exceptions are added; or disable the T3 protocol entirely if it is unused, noting that dynamic clustering, some migration features, and WLST-based tooling depend on T3. Complement these with monitoring for anomalous T3/IIOP handshakes and failed or malformed protocol requests, and review whether the affected instances need to be internet-facing at all. Because no public exploit code has been identified at time of analysis, emergency internet-wide scanning is less urgent than for a KEV-listed issue, but the unauthenticated, low-complexity nature of the bypass means T3/IIOP exposure should be treated as an urgent configuration finding now.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in WebLogic Server's Core component and is classified as CWE-287 (Improper Authentication): a request path over Oracle's proprietary T3 protocol and/or the CORBA-based IIOP protocol reaches a code path that fails to validate authentication properly, letting an unauthenticated peer assume the privileges of the server process. T3 is WebLogic's RMI-style remoting protocol used for Java-to-Java calls, WLST/JMX management, and inter-server clustering traffic, while IIOP exposes CORBA object invocation; both listeners are enabled by default in standard deployments and normally share the administration/managed server HTTP port (typically 7001), which is why the assessed vector is network-only with low complexity and no privileges or user interaction (PR:N/UI:N). The assessed scope is unchanged (S:U), so the compromise is confined to the WebLogic instance and its hosted applications/data rather than an implied hypervisor escape, but C/I/A are all rated High because authentication bypass on a JEE application server typically yields deployment of arbitrary applications, access to data sources, and credential material. Because the defect is protocol-level (T3/IIOP handshake handling) and not tied to a specific web application, mitigation must address protocol reachability rather than a single endpoint; the EUVD entry (EUVD-2026-79509) confirms the same four affected 12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0 / 15.1.1.0.0 release lines.
Know when Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle-described unauthenticated, low-complexity T3/IIOP network attack yielding full server takeover; default-enabled protocol supports AV:N/AC:L/PR:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are exposed to unauthenticated remote takeover through default-enabled T3 and IIOP listeners, allowing an attacker to fully compromise confidentiality, integrity, and availability without credentials or user interaction. Any organization running these versions with network reachability to the listeners-including internet-facing and internal deployments-is at risk, and no vendor patch is currently available, making mitigation dependent on network controls. Leadership should treat this as a critical exposure requiring immediate action to reduce attack surface and monitor for exploitation attempts.
Disable T3/IIOP listeners if not required; enforce network access controls (firewall, security groups, connection filters) to restrict T3/IIOP ports to trusted sources; segment WebLogic servers from untrusted networks; monitor for anomalous T3/IIOP traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Exploit-DB