Oracle WebLogic Server CVE-2026-70757

Exploitation requires the WebLogic T3 or IIOP protocol listener to be reachable from the attacker - these run on the WebLogic administration/managed-server listen port and are enabled by default, so most standard deployments are exposed unless T3/IIOP has been explicitly filtered, disabled, or firewalled. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and Oracle rates it 'easily exploitable.' Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The primary limiting factor is network reachability of the T3/IIOP port: organizations that restrict these protocols via connection filters (weblogic.security.net.ConnectionFilterImpl) or network segmentation substantially reduce exposure.

This is a genuine top-priority vulnerability, and the signals largely agree. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) is well-calibrated: Oracle's own description states an unauthenticated attacker with network access via the T3 or IIOP protocols can achieve full 'takeover' of the server, which maps cleanly to C:H/I:H/A:H with no privileges or user interaction. Oracle rates this as 'easily exploitable,' consistent with AC:L. No EPSS score, KEV listing, or public POC was provided in the input, so at time of analysis there is no public exploit identified and no confirmed active exploitation - but this must be read with caution: WebLogic T3/IIOP flaws (the Weblogic deserialization lineage, e.g. CVE-2020-2551, CVE-2020-14882) are historically among the most rapidly weaponized and mass-exploited server bugs, routinely appearing in CISA KEV and commodity botnets within weeks of a CPU. The absence of EPSS/KEV data here reflects data gaps in this feed, not low real-world risk. One labeling caveat: the CWE-287 classification and 'Authentication Bypass' tag understate the outcome - the actual impact is remote code execution/full takeover, not merely bypassing a login. Treat as critical and patch on Oracle's emergency cadence.

An attacker locates an internet- or network-reachable WebLogic instance with the T3 or IIOP listener exposed (the default protocols on the WebLogic listen port) and sends a crafted T3/IIOP request that abuses the Core component to execute code without any credentials. Because no authentication or user interaction is required and the attack is network-based, this is directly exploitable at scale against exposed servers. No public POC was provided in this dataset, but this vulnerability class is historically trivial to weaponize once details or patches are diffed.