WebLogic Proxy Plug-in CVE-2026-87300

Requires the Oracle WebLogic Server Proxy Plug-in to be deployed on a third-party web server (Apache HTTP Server, Microsoft IIS, or iPlanet/Oracle iPlanet) that fronts a WebLogic backend and is reachable over HTTP by the attacker. No authentication is required (PR:N) and no user interaction is needed (UI:N), so the limiting factor is NOT access control but the HIGH attack complexity (AC:H): Oracle classifies this as 'Difficult to exploit,' implying the attacker must satisfy specific conditions or timing not controllable at will. Exploitation is further limited to the three listed supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0); environments not using the proxy plug-in (direct-to-WebLogic deployments) are not exposed. Availability is unaffected (A:N), so this is a data confidentiality/integrity risk rather than a denial-of-service vector.

This is a genuine high-priority issue but not a drop-everything emergency based on available signals. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 8.7) shows a network-reachable, unauthenticated flaw with a scope change and high confidentiality/integrity impact, which Oracle itself rates HIGH. The key tempering factor is AC:H - Oracle explicitly describes it as a 'Difficult to exploit vulnerability,' meaning the attacker must win a race, meet specific conditions, or defeat non-trivial preconditions rather than fire a single deterministic request. No EPSS score was provided, so exploitation probability cannot be quantified; this is a data gap, not evidence of low risk. The CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Oracle provides no SSVC decision data. Net assessment: a serious, patch-worthy flaw given the unauthenticated network vector and scope change, but the AC:H rating and absence of any public exploit or KEV listing mean it is below the tier of trivially-exploitable, actively-weaponized bugs. Prioritize patching in the next planned Oracle CPU cycle, accelerated for internet-exposed proxy tiers.

An attacker with network access sends specially crafted HTTP requests to a third-party web server (e.g., Apache or IIS) running the WebLogic Server Proxy Plug-in, exploiting a difficult-to-trigger flaw to read or tamper with critical data passing through the proxy. Because of the scope change, a successful attack may extend impact beyond the plug-in to the backend WebLogic application and other connected products. No public proof-of-concept is referenced, and the high attack complexity means exploitation likely requires precise timing or specific conditions rather than a single simple request.