EUVD-2026-46757
GHSA-9hm6-79cm-xrr8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reach with low complexity and no interaction, but a low-privilege authenticated foothold is required (PR:L); full server takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware, Core component) lets a low-privileged attacker with only HTTP network access compromise the entire server. Successful exploitation delivers high confidentiality, integrity, and availability impact (CVSS 3.1 8.8), effectively granting control of the WebLogic instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the WebLogic HTTP interface plus low-privilege authentication (CVSS PR:L) - the attacker must already possess valid low-level credentials or a comparable authenticated foothold on the target, so this is not an unauthenticated pre-auth attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with full-triad impact - a strong prioritization signal reinforced by Oracle's own 'easily exploitable' language. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted a low-privilege WebLogic account sends crafted HTTP requests to the Core component of an exposed WebLogic 12.2.1.4.0 or 14.1.1.0.0 instance and escalates to full control of the server, reading or altering hosted data and disrupting service. No user interaction is required and attack complexity is low, so once a foothold credential exists the takeover is straightforward; no public POC is currently referenced, which is the main practical barrier. |
| Remediation | Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.1.0.0 branches; Oracle's input does not enumerate a discrete fixed build number beyond the CPU bundle, so schedule the CPU patch set as the primary and authoritative remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle WebLogic Server instances to identify those running versions 12.2.1.4.0 or 14.1.1.0.0 and escalate any production systems to incident response. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today