Oracle WebLogic Server CVE-2026-91323

No special conditions - remote unauthenticated exploitation over HTTP against default configurations of Oracle WebLogic Server (Core component), per the Oracle description stating an unauthenticated attacker with network access via HTTP can take over the server (CVSS PR:N/UI:N/AC:L). The practical limiting factors are therefore network reachability of the WebLogic HTTP/T3 listener (exposure can be reduced by firewalling or restricting the admin/managed-server ports) and running one of the affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; no authentication, user interaction, or non-default feature toggle is required. The exact vulnerable Core feature is not specified because the CWE is 'N/A' in the source data.

All available signals point to a genuine top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes an unauthenticated, network-reachable flaw with low attack complexity, no user interaction, and full confidentiality/integrity/availability impact resulting in complete server takeover - the highest-risk profile a single component flaw can have. These CVSS signals are internally consistent with the Oracle description, which explicitly states 'unauthenticated attacker with network access via HTTP' and 'takeover of Oracle WebLogic Server.' However, several real-world-risk signals are MISSING from the input and must be stated explicitly: no EPSS exploitation-probability score is provided, CISA KEV status is not indicated (treated as NO), no public POC is referenced, no SSVC decision data is supplied, and the CWE is 'N/A' so the exact flaw class (deserialization, SSRF, auth bypass, etc.) cannot be confirmed. Historically Oracle WebLogic unauthenticated RCE/takeover flaws in the Core component are rapidly weaponized and heavily targeted (e.g. prior deserialization CVEs appeared in KEV), so despite the current absence of KEV/POC/EPSS data this should be treated as an imminent patch priority rather than a 'high-CVSS-but-low-real-risk' issue. The one data inconsistency to flag: the input Tag 'Information Disclosure' conflicts with the C:H/I:H/A:H 'takeover' impact, which is far broader than mere disclosure - verify against the Oracle CPU advisory.

A remote attacker with no credentials sends a crafted HTTP request directly to an internet- or network-exposed WebLogic Server Core listener, exploiting the flaw to achieve full compromise of the server. Because the attack requires no authentication, no user interaction, and only low complexity, a single request against a default-configured instance can lead to complete takeover. No public exploit identified at time of analysis, but the profile matches historically mass-scanned WebLogic flaws.