Oracle Weblogic Server
Monthly
Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.
Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network HTTP access to fully compromise confidentiality, integrity, and availability of the server. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's July 2026 Critical Patch Update, the flaw requires only low-level authenticated access and no user interaction, making it attractive for post-authentication lateral movement. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, network-adjacent attacker abusing the SAML authentication path, with a scope change that can propagate impact into additional connected products. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 9.9 rating reflects complete loss of confidentiality, integrity and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low complexity and low privilege requirement make it a top-priority patching item.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a remote unauthenticated attacker with only TCP network access to fully compromise the server. The maximum-severity CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects that successful exploitation yields complete confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but WebLogic's history as a mass-exploited target makes this a high-priority patch.
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker fully compromise the server by sending crafted requests over the T3 or IIOP protocols. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and calls it 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not in CISA KEV, but this class of unauthenticated T3/IIOP takeover has historically been rapidly weaponized in WebLogic.
Server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged, remote attacker with HTTP network access to fully compromise the server, per the Oracle July 2026 Critical Patch Update. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates the flaw 'easily exploitable' with high confidentiality, integrity and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-network vector make it a high-priority patch item.
Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote attacker fully compromise affected instances by sending crafted traffic over the T3 or IIOP protocols. It carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) is possible by an unauthenticated attacker sending crafted traffic over the T3 or IIOP protocols against versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 3.1 8.1 with full confidentiality, integrity, and availability compromise, but flags high attack complexity (AC:H), meaning the flaw is difficult to exploit despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is currently a patch-priority based on impact rather than confirmed exploitation.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via a crafted SOAP request. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, and Oracle rates it easily exploitable with complete confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit was identified at time of analysis, but given WebLogic's history as a mass-exploitation target, this warrants immediate patching from the July 2026 Critical Patch Update.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via HTTP, per Oracle's July 2026 Critical Patch Update. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a maximum-severity CVSS 3.1 score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but WebLogic's history as a repeated exploitation target makes this a high-priority patch.
Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated attackers who reach the T3 or IIOP remoting protocols over the network. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning any exposed T3/IIOP listener on affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 builds can be commandeered without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of weaponized deserialization exploits, so patch urgency is high.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 (Core component) allows a high-privileged attacker positioned on the adjacent physical communication segment to compromise the server and, due to a scope change, significantly impact additional connected products. Successful exploitation yields complete loss of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full server takeover of Oracle WebLogic Server (Fusion Middleware, Console component) is achievable by an already-authenticated high-privileged attacker reaching the management Console over HTTPS. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and successful exploitation yields complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.
Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.
Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.
Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.
Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.
Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network HTTP access to fully compromise confidentiality, integrity, and availability of the server. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's July 2026 Critical Patch Update, the flaw requires only low-level authenticated access and no user interaction, making it attractive for post-authentication lateral movement. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, network-adjacent attacker abusing the SAML authentication path, with a scope change that can propagate impact into additional connected products. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 9.9 rating reflects complete loss of confidentiality, integrity and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low complexity and low privilege requirement make it a top-priority patching item.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a remote unauthenticated attacker with only TCP network access to fully compromise the server. The maximum-severity CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects that successful exploitation yields complete confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but WebLogic's history as a mass-exploited target makes this a high-priority patch.
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker fully compromise the server by sending crafted requests over the T3 or IIOP protocols. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and calls it 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not in CISA KEV, but this class of unauthenticated T3/IIOP takeover has historically been rapidly weaponized in WebLogic.
Server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged, remote attacker with HTTP network access to fully compromise the server, per the Oracle July 2026 Critical Patch Update. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates the flaw 'easily exploitable' with high confidentiality, integrity and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-network vector make it a high-priority patch item.
Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote attacker fully compromise affected instances by sending crafted traffic over the T3 or IIOP protocols. It carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) is possible by an unauthenticated attacker sending crafted traffic over the T3 or IIOP protocols against versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 3.1 8.1 with full confidentiality, integrity, and availability compromise, but flags high attack complexity (AC:H), meaning the flaw is difficult to exploit despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is currently a patch-priority based on impact rather than confirmed exploitation.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via a crafted SOAP request. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, and Oracle rates it easily exploitable with complete confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit was identified at time of analysis, but given WebLogic's history as a mass-exploitation target, this warrants immediate patching from the July 2026 Critical Patch Update.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via HTTP, per Oracle's July 2026 Critical Patch Update. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a maximum-severity CVSS 3.1 score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but WebLogic's history as a repeated exploitation target makes this a high-priority patch.
Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated attackers who reach the T3 or IIOP remoting protocols over the network. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning any exposed T3/IIOP listener on affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 builds can be commandeered without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of weaponized deserialization exploits, so patch urgency is high.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 (Core component) allows a high-privileged attacker positioned on the adjacent physical communication segment to compromise the server and, due to a scope change, significantly impact additional connected products. Successful exploitation yields complete loss of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full server takeover of Oracle WebLogic Server (Fusion Middleware, Console component) is achievable by an already-authenticated high-privileged attacker reaching the management Console over HTTPS. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and successful exploitation yields complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.
Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.