Oracle WebLogic Server EUVD-2026-105928

Exploitable by an unauthenticated remote attacker (PR:N) over HTTP against network-reachable Oracle WebLogic Server instances (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) via the Centralized Thirdparty Jars component, with no user interaction. The key LIMITING factor is the high attack complexity (AC:H): Oracle explicitly classifies this as 'difficult to exploit,' so the attacker must meet conditions beyond their direct control (e.g. specific timing, server state, or configuration), which substantially reduces reliable mass exploitation. No specific feature-enablement prerequisite is named in the description; exposure is driven by whether the WebLogic HTTP interface is reachable from the attacker's network position.

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.9) in Oracle WebLogic Server. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N shows the attractive side - network-reachable over HTTP with no authentication (PR:N) and no user interaction (UI:N) - but the AC:H (high attack complexity) is the decisive mitigating signal: Oracle rates this 'difficult to exploit,' meaning success depends on conditions outside the attacker's control (timing, configuration, or specialized knowledge), not a trivially repeatable request. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of critical data, but no integrity or availability loss and no scope change. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no current evidence of exploitation probability or active abuse. Net: this is a real but second-tier priority - patch it on the normal Oracle CPU cadence rather than as an emergency, unless the affected host handles highly sensitive data. The AC:H complexity and absence of any exploitation signal argue against treating it as an actively weaponized threat, while the unauthenticated network reach and C:H impact keep it above a trivial issue. Note the input Tag 'Authentication Bypass' conflicts with the actual nature of the flaw, which is an unauthenticated information-disclosure issue, not an authentication-bypass - verify the classification.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an internet- or network-exposed WebLogic Server instance, abusing the Centralized Thirdparty Jars component to read data it should not be able to access. Because the flaw is rated difficult to exploit (AC:H), the attacker likely needs favorable timing or specific server conditions rather than a single reliable request. No public exploit code is identified at time of analysis.