EUVD-2026-79349
GHSA-g2wh-mcrv-5m76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing WebLogic HTTP listener
-
DeliverySend crafted request to Web Container
-
ExploitBypass authentication (CWE-287)
-
ExecutionExecute code / take over server
-
ImpactPivot to additional products (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle WebLogic Server (Web Container component), consistent with AV:N/AC:L/PR:N/UI:N. Exploitation only requires network reachability to the WebLogic HTTP listener on affected versions 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0. Limiting factors are minimal: the primary mitigation is not exposing the WebLogic HTTP port to untrusted networks and applying the Oracle Sept 2026 CPU (cspusep2026). The scope change (S:C) means impact can extend to additional products beyond WebLogic itself. |
| Impact | This is a top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) yields a maximum base score of 10.0 - network-reachable over HTTP, low attack complexity, no privileges, no user interaction, full confidentiality/integrity/availability impact, plus a scope change (S:C) indicating Oracle's own note that 'attacks may significantly impact additional products.' Oracle describes it as 'easily exploitable' by an unauthenticated attacker, and CWE-287 (Improper Authentication) is consistent with the 'Authentication Bypass' tag. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - but absence of these signals does NOT lower priority here: WebLogic pre-auth flaws are historically among the most rapidly weaponized enterprise bugs (e.g., CVE-2020-14882, CVE-2019-2725, both eventually exploited in the wild). The only caveat is that the Oracle advisory (cspusep2026) provides zero technical detail - no endpoint, protocol handler, or affected feature - so the exact attack surface must be confirmed once patch-diffing or vendor detail emerges. Treat as emergency-patch grade. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach a WebLogic Server's HTTP listener sends a single crafted request to a vulnerable Web Container endpoint, bypassing authentication (CWE-287) to achieve full server takeover. Because of the scope change, the attacker can pivot beyond WebLogic itself to impact co-located or downstream products. No public exploit code is identified at time of analysis, but the low-complexity, no-privilege profile makes reliable exploitation likely once technical detail surfaces. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
RemediationAI
Apply the Oracle Critical Patch Update referenced in the vendor advisory at https://www.oracle.com/security-alerts/cspusep2026.html, which is the patch source for CVE-2026-83021 - patch availability is confirmed per vendor advisory, though no exact fixed build number was provided in the available data, so confirm the applicable patch revision and post-patch version in Oracle's CPU document before relying on it. Because exploitation only requires network reachability to the WebLogic HTTP listener (AV:N/AC:L/PR:N), the highest-value compensating control is to stop exposing the WebLogic HTTP port to untrusted networks: place the server behind a restricted reverse proxy, firewall allowlists, or VPN-only access, accepting that this constrains legitimate client traffic and requires careful allowlisting of real consumers. If exposure cannot be removed immediately, enforce network segmentation so a compromised WebLogic host cannot reach the additional products implied by the Scope:Changed rating, and deploy a WAF or reverse proxy rule set tuned to reject anomalous pre-authentication requests - noting that generic signatures are unreliable for authentication-bypass flaws and may cause false positives on legitimate traffic. On the host, restrict administrative and console interfaces to trusted management networks and remove unnecessary Web Container applications until patching is complete; trade-offs include reduced application availability and added operational overhead for access exceptions. Rotate credentials, session tokens, and any secrets stored or proxied by affected WebLogic instances, since an authentication bypass of this severity must be treated as potential full compromise of the server and anything it trusts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-287 (Improper Authentication), a defect in how Oracle WebLogic Server's Web Container validates or enforces authentication on requests delivered through its HTTP interface. WebLogic's Web Container implements the servlet/HTTP request handling layer, and a flaw there allows a network attacker to bypass authentication entirely and operate with the privileges of the application server rather than as an anonymous user. Because the defect sits in a network-facing, pre-authentication code path (PR:N, UI:N, AC:L), it is exploitable in a single, low-complexity step once the HTTP listener is reachable. The CVSS vector's S:C component is significant: Oracle's assessment states that while the vulnerable code is in WebLogic Server, successful attacks can significantly impact additional products, meaning a compromised WebLogic instance may be usable as a pivot or trusted foothold into co-deployed or federated systems. Affected versions per this advisory and ENISA EUVD are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 of Oracle Fusion Middleware's WebLogic Server. Exact CPE identifiers were not supplied in the available intelligence, so version matching should be confirmed against the Oracle advisory rather than inferred.
Know when Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Oracle states unauthenticated, easily exploitable HTTP attack yielding full takeover with cross-product impact, so PR:N/AC:L/AV:N with S:C and full C/I/A.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 are affected by a maximum-severity unauthenticated authentication bypass that can allow attackers with only HTTP network access to achieve full system takeover and potentially affect interconnected products. Any internet-facing or broadly reachable WebLogic deployment therefore represents an immediate enterprise-wide risk requiring leadership attention. No public exploit identified at time of analysis, but the absence of a vendor-released patch elevates urgency for containment and exposure reduction.
No vendor-released patch identified at time of analysis; restrict network access to WebLogic HTTP listeners, segment affected systems, deploy WAF/virtual patching rules if available, disable non-essential services, and monitor for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Exploit-DB