WebLogic Proxy Plug-in CVE-2026-83379

Requires a deployment where the Oracle WebLogic Server Proxy Plug-in is installed on a third-party web server (Apache HTTP Server, Microsoft IIS, or similar) fronting WebLogic, and that proxy endpoint must be network-reachable over HTTP by the attacker - internet-facing proxies are the primary exposure. No authentication is required (PR:N) and no user interaction (UI:N). The key LIMITING factor is high attack complexity (AC:H): Oracle labels it 'difficult to exploit,' indicating success depends on conditions beyond the attacker's direct control (such as specific timing, request sequencing, or server state), which meaningfully reduces realistic exploitability despite the unauthenticated network vector. Environments not using the proxy plug-in for third-party web servers are not affected.

This is a genuinely serious but nuanced finding. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 8.7) describes a network-reachable, unauthenticated (PR:N) flaw over HTTP with a scope change (S:C) and high confidentiality and integrity impact, which is why Oracle rates it High. The single most important mitigating signal is the high attack complexity (AC:H) - Oracle explicitly calls it a 'difficult to exploit vulnerability,' meaning successful attacks likely require specific conditions, timing, or preparation outside the attacker's full control rather than a simple one-shot request. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at the time of analysis and no evidence of active or widespread exploitation. The signals are therefore internally consistent rather than conflicting: a high-severity, unauthenticated, scope-changing bug that is hard to trigger and not currently known to be exploited. Net assessment - a real patch-promptly priority for any org fronting WebLogic with the proxy plug-in (especially internet-facing proxies), but the AC:H barrier and absence of exploitation signals argue against emergency/out-of-band response. The 'Authentication Bypass' tag is not corroborated by the description, which characterizes the impact as unauthorized data read/modify via a scope change, not a bypass of an auth mechanism; treat that tag as unverified.

An unauthenticated attacker reachable over the network sends specially crafted HTTP traffic to a third-party web server (e.g., Apache or IIS) running the Oracle WebLogic Server Proxy Plug-in. By exploiting the flaw under the required difficult-to-achieve conditions, the attacker reads and tampers with critical data and, due to the scope change, extends impact to additional backend products. No public proof-of-concept was provided, and the high attack complexity means reliable exploitation would require meeting specific preconditions.