Oracle WebLogic Server CVE-2026-83399

No special conditions beyond network reachability - remote unauthenticated exploitation against default configurations of Oracle WebLogic Server via the T3 or IIOP protocols. The practical limiting factor is network exposure of the T3/IIOP listener ports: environments that firewall, disable, or filter T3/IIOP (e.g., restrict these protocols to trusted management networks via connection filters) substantially reduce exposure. Affected builds are Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; other versions are not listed as affected. No authentication, no user interaction, and no non-default feature enablement are required, which is why this ranks as critical.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: network-reachable, low attack complexity, no privileges, and no user interaction, with full C:H/I:H/A:H impact yielding complete server takeover. The description reinforces this independently, stating an unauthenticated attacker with network access via the T3 or IIOP protocols can compromise the server. The attack surface - Oracle WebLogic T3/IIOP - is historically one of the most heavily and reliably weaponized in enterprise software (prior WebLogic deserialization flaws have been routinely mass-exploited), which raises real-world concern even though exploitation-probability signals are absent here. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so exploitation status must be stated as 'no public exploit identified at time of analysis.' The conflict to note explicitly: the input Tags label this 'Information Disclosure,' but both the CVSS impact (I:H/A:H, not confidentiality-only) and the description ('takeover') indicate full compromise - the tag understates the severity and should not be relied upon. Given WebLogic's internet exposure and exploitation history, this warrants emergency patching despite the lack of EPSS/KEV/POC data.

An attacker locates an internet- or network-exposed WebLogic instance with the T3 or IIOP ports reachable (default on many deployments), then sends a crafted T3/IIOP request to the Core component that exploits the flaw without any authentication or user interaction. The single request results in complete takeover of the WebLogic Server. No public exploit code was identified in the provided data, but the AV:N/AC:L/PR:N/UI:N profile means a working exploit would be trivial to use at scale once developed.