Oracle WebLogic Server CVE-2026-87302

No special configuration conditions are stated by Oracle - exploitation requires only network access to an Oracle WebLogic Server HTTP interface (the Core component), with no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L), consistent with reaching a default-exposed HTTP/T3-over-HTTP listener. The primary limiting factor is network reachability: WebLogic instances restricted to internal segments or behind a WAF/reverse proxy that filters the vulnerable endpoint materially reduce exposure, whereas internet-facing listeners are directly exploitable. Affected deployments must be running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; other versions are out of scope per the advisory.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is the worst-case exploitability profile: remote, low-complexity, unauthenticated, no user interaction, delivered over HTTP. Oracle's own description reinforces this ('easily exploitable... unauthenticated attacker with network access via HTTP'), and the C:H/I:H impact means full read plus unauthorized creation/deletion/modification of all WebLogic-accessible data. Availability is unaffected (A:N), so this is a data-compromise rather than a DoS issue. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no current signal of active exploitation or widespread weaponization - but Oracle WebLogic Core flaws of this profile have historically been rapidly targeted after Critical Patch Updates, so the absence of a KEV listing should be read as 'not yet observed/listed' rather than 'low risk.' Note a signal gap: EPSS and exploit-maturity data are missing entirely, so real-world exploitation likelihood cannot be quantified from the provided data and should be re-checked against CISA KEV and EPSS feeds after the Oracle October 2026 CPU.

An attacker with network reachability to a WebLogic Server HTTP(S) listener sends a crafted request to the vulnerable Core component without any credentials, bypassing authentication to read and modify all server-accessible data. No user interaction or prior foothold is required, making internet-exposed WebLogic admin/HTTP ports directly at risk. No public exploit code was identified in the provided data at the time of analysis.