EUVD-2026-79511
GHSA-qx4v-9wjm-r797
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed T3/IIOP listener (7001)
-
ExploitSend crafted T3/IIOP protocol message
-
ExecutionTrigger unauthenticated code execution in Core
-
ImpactAchieve full WebLogic server takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the WebLogic Server's T3 or IIOP protocol listener (by default the same port as the admin/managed server, commonly 7001), which must be reachable by the attacker. No authentication and no user interaction are needed (PR:N/UI:N), and default configurations of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are exploitable. The primary limiting factor is network exposure of the T3/IIOP listener: environments that firewall, disable, or filter T3/IIOP (a standard hardening step and common mitigation for this vulnerability class) substantially reduce or eliminate exposure, so internet-facing WebLogic instances with open T3/IIOP are at greatest risk. |
| Impact | This is a genuine top-priority vulnerability, not a CVSS-inflation artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity, and availability impact - and Oracle's own language ('easily exploitable... unauthenticated attacker... takeover') reinforces that the vector is accurate rather than overstated. All three impact metrics being High plus 'takeover' indicates full server compromise, consistent with the historical pattern of WebLogic T3/IIOP flaws. Signal completeness is the main gap: there is no EPSS score, no SSVC decision data, no POC flag, and no CISA KEV listing in the provided input, so exploitation status is 'no public exploit identified at time of analysis.' That absence should NOT be read as low risk - WebLogic T3/IIOP takeover bugs are a repeatedly weaponized class (Oracle CPU perennials), so weaponization typically follows patch disclosure quickly even when day-one telemetry is empty. One data note: the CWE is tagged CWE-287 (Improper Authentication) and the tag says 'Authentication Bypass,' but a network T3/IIOP 'takeover' resulting in full C/I/A compromise is characteristically an unsafe-deserialization/RCE pattern (CWE-502) rather than a pure auth bypass - verify the precise root cause with Oracle before assuming credential-layer mitigations suffice. |
| Exploit ScenarioDerived | An attacker with network reachability to a WebLogic server's T3 or IIOP listener (default 7001) sends a crafted protocol message that triggers server-side code execution without any credentials, yielding full control of the WebLogic instance and the applications and data it hosts. No public exploit is identified in the provided data, but this vulnerability class is historically trivial to weaponize once patch details are reverse-engineered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
RemediationAI
Apply the Oracle Fusion Middleware Critical Security Patch Update published in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html; a vendor patch is available per that advisory, but no single exact fix version string is stated in the supplied data, so verify the patched build for each branch (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) against the advisory before deploying. Where patching cannot be completed immediately, the highest-value compensating control is to eliminate the attack surface: disable the T3 and IIOP protocols and/or restrict inbound access to the listener port (commonly 7001) so only trusted management hosts can reach it, since the vulnerability's only practical precondition is network reachability of T3/IIOP. The trade-off is that disabling T3 breaks WLST, remote JMS, remote EJB, and some cluster and console functionality, while blocking IIOP breaks RMI-IIOP/CORBA clients, so schedule these changes with application owners. A more surgical alternative is to deploy WebLogic's connection filter (weblogic.security.net.ConnectionFilterImpl) to allow-list source addresses for T3/IIOP while leaving the protocol enabled, accepting that the filter must be maintained accurately. Internet-facing instances with open T3/IIOP should be treated as the highest priority, and older 12.2.1.4.0 deployments should be considered for migration to a currently supported patched branch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-287 (Improper Authentication), meaning the server fails to correctly establish or verify the identity of a requester before granting privileged access, rather than memory corruption or injection. The attack surface is WebLogic's own remoting protocols: T3 is Oracle's proprietary RMI-based transport used by the administration console, WLST, JMS, remote EJB, and internal cluster traffic, while IIOP is the CORBA interoperability protocol used for RMI-IIOP clients. Both are exposed by default on the same network listener as the administration and managed servers (typically 7001), which is why CWE-287 defects in this layer have historically been highly exploitable and why the assessed vector reaches PR:N/UI:N with no special conditions beyond network reachability. This places CVE-2026-70756 in the same architectural family as earlier WebLogic T3/IIOP authentication and deserialization bypasses, where the protocol endpoint rather than a business application is the entry point. The Oracle Fusion Middleware Critical Security Patch Update advisory (cspusep2026) is the authoritative vendor source for patched builds.
Know when Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated low-complexity T3/IIOP request yields full server takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; scope unchanged as compromise stays within the WebLogic process.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebLogic Server (Core component) is affected by a critical authentication bypass (CVE-2026-70756, CVSS 9.8) that allows unauthenticated, network-positioned attackers to achieve full server takeover across all supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, organizational exposure is determined by whether the T3 or IIOP listener (commonly port 7001) is reachable from untrusted networks. Leadership should prioritize immediate network-level restrictions because a successful exploit would compromise confidentiality, integrity, and availability of critical business applications hosted on WebLogic.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting reachability of the T3 or IIOP protocol listener (commonly port 7001) to trusted management networks, disabling T3/IIOP where not operationally required, enforcing network segmentation, and monitoring for anomalous T3/IIOP traffic. Consult Oracle's advisory for any vendor-provided workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Exploit-DB