EUVD-2026-79366
GHSA-vv3j-hh67-rj4f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySend crafted HTTP request to TopLink Integration
-
ExploitTrigger flaw enabling code/data compromise
-
ExecutionEscalate to full WebLogic takeover
-
ImpactImpact additional products via scope change
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the TopLink Integration component of Oracle WebLogic Server and a low-privileged authenticated foothold (PR:L) - it is NOT fully unauthenticated. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Once exploited it results in full server takeover with a scope change (S:C) that may significantly impact additional co-located products. The primary limiting factor is the low-privilege authentication requirement; no user interaction is needed (UI:N) and attack complexity is low (AC:L) against affected versions. Oracle publishes no configuration prerequisites, so default installations of the listed versions are presumed exploitable by an authenticated actor. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L, an authenticated but non-admin user), with a scope change (S:C) and full confidentiality/integrity/availability compromise resulting in takeover of Oracle WebLogic Server. The score of 9.9 is well-calibrated and honestly reflects the authentication requirement - it is one notch below the pre-auth WebLogic Web Container sibling CVE-2026-83021 (10.0, PR:N). No exploitation-probability signals are available: EPSS is not provided, the flaw is not in CISA KEV, and no public exploit code is identified. SSVC decision data is also absent. There is a metadata conflict to note: the input Tags label this 'Information Disclosure', which contradicts the description's full-triad takeover (C:H/I:H/A:H) - the label understates real impact and should not be relied upon. Given WebLogic's history as a mass-exploited target (the pre-auth lineage of CVE-2020-14882 etc.), even a PR:L flaw with scope change on a widely deployed Java application server warrants prompt patching, but note that the PR:L requirement (attacker must hold some valid low-privilege access) is a meaningful limiter versus fully unauthenticated WebLogic flaws. |
| Exploit ScenarioDerived | An attacker holding low-privilege authenticated access to a WebLogic Server (or who has obtained low-level credentials) sends crafted HTTP requests to the TopLink Integration component, exploiting the flaw to escalate to full server takeover. Because the scope changes (S:C), the compromise can extend beyond WebLogic to impact additional co-located products. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An authenticated, low-privileged attacker with network access over HTTP can achieve full takeover of Oracle WebLogic Server through its TopLink Integration component in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Because attack complexity is low, no user interaction is required, and the scope is changed, a successful exploit can compromise the confidentiality, integrity and availability of the server and may significantly impact additional, dependent or co-located products. The reachability of the flaw is limited only by the requirement for a low-privileged authenticated foothold; no public exploit identified at time of analysis and the issue does not appear in CISA KEV, so risk is driven by the severity and broad enterprise exposure of WebLogic rather than by observed exploitation.
RemediationAI
No vendor-released patch version is confirmed in the available data; the authoritative fix is the Oracle Critical Patch Update described in the Oracle Security Alert at https://www.oracle.com/security-alerts/cspusep2026.html, which should be applied to every deployment running WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0 (confirm the exact patched build in that advisory and in Oracle's CPU documentation before validating remediation). Until the update is applied, prioritize compensating controls that address the low-privileged authenticated prerequisite: restrict and aggressively review all network paths to WebLogic's HTTP listener and administrative endpoints so that only trusted application tiers and administrators can reach them, since exposing the listener widens the attack surface for an already-authenticated user (trade-off: legitimate application and console access must be re-routed, and remote administration may require a bastion or VPN). Audit and minimize low-privileged accounts that can authenticate to the server or to hosted applications, remove unused accounts, and rotate credentials, because PR:L means an ordinary user credential is sufficient (trade-off: tighter account governance can disrupt application service accounts, so test changes before enforcement). Where TopLink/EclipseLink integration features are not required by deployed applications, consider disabling or restricting the TopLink Integration component and its remote descriptor/session deployment paths through WebLogic's deployment and security configuration (trade-off: JPA/EclipseLink-based applications may fail to deploy or function, so this must be validated in a staging environment first). Additionally, enable and monitor WebLogic security and HTTP access logs for anomalous TopLink-related requests from low-privileged principals, and use WAF or network filtering rules to block unexpected requests to integration endpoints as a detection-and-delay layer rather than a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable code sits in Oracle WebLogic Server's TopLink Integration component, part of Oracle Fusion Middleware. TopLink/EclipseLink-based persistence integration allows deployed applications to register and use object-relational mapping and session/descriptor metadata inside the application server, so the integration layer parses and acts on application-supplied metadata and HTTP-exposed requests rather than remaining purely internal. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates the attack surface is reachable over the network with low complexity and only a low-privileged authenticated account, that no victim interaction is needed, and that the security scope changes (S:C) - meaning impact is not confined to WebLogic's own security authority and can propagate to other products sharing the environment. No CWE is published for this CVE, so the precise root-cause class (for example deserialization, injection, or improper access control in the integration layer) is not confirmed by the available data; the assessed vector and Oracle's own "easily exploitable" rating are the authoritative characterization. Oracle publishes no configuration prerequisites for this issue, so default installations of the listed versions are presumed exploitable by an authenticated actor, and the vendor advisory referenced in the intelligence (Oracle Security Alert cspusep2026) is the source of truth for the fix.
Know when Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP with low complexity and no user interaction; low-privilege auth required per description (PR:L); vendor-stated scope change and takeover justify S:C and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
A critical-rated flaw in Oracle WebLogic Server's TopLink Integration component (CVE-2026-83038, CVSS 9.9) allows anyone holding even a basic, low-privileged account on the server to seize full control of it and potentially of connected or co-hosted systems. WebLogic typically sits behind customer-facing and revenue-critical applications, so a single compromised account could expose sensitive data, corrupt transaction integrity, and cause extended outages. Leadership should treat this as a priority remediation item affecting any business unit running WebLogic 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, even though no public exploit code or active exploitation has been identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the TopLink Integration component and WebLogic HTTP interfaces via segmentation and firewall rules, minimizing and monitoring low-privileged accounts that could serve as the required authenticated foothold, applying least-privilege and credential rotation, deploying WAF/IDS rules to detect exploitation attempts, and applying Oracle's forthcoming vendor guidance or interim fix as soon as it is published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Exploit-DB