Weblogic Server Proxy Plug In
Monthly
Unauthenticated remote compromise of the Oracle WebLogic Server Proxy Plug-in (version 15.1.1.0.0), a module that fronts WebLogic behind third-party web servers such as Apache HTTP Server and Oracle HTTP Server, allowing a network attacker to read and modify critical data with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the flaw crosses a trust boundary (scope change), meaning exploitation of the plug-in significantly impacts additional connected products. Vendor tagging identifies it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability warrants urgent patching.
Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthenticated network attackers to fully compromise the middleware layer.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthenticated remote compromise of the Oracle WebLogic Server Proxy Plug-in (version 15.1.1.0.0), a module that fronts WebLogic behind third-party web servers such as Apache HTTP Server and Oracle HTTP Server, allowing a network attacker to read and modify critical data with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the flaw crosses a trust boundary (scope change), meaning exploitation of the plug-in significantly impacts additional connected products. Vendor tagging identifies it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability warrants urgent patching.
Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthenticated network attackers to fully compromise the middleware layer.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.