Weblogic Server
Monthly
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Full server takeover in Oracle WebLogic Server Core component is achievable by unauthenticated remote attackers via the T3 and IIOP protocols, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the targeted server instance. No public exploit has been identified at time of analysis, and exploitation is constrained by high attack complexity; however, WebLogic's T3/IIOP surface has a well-established history of critical deserialization exploits that warrants prioritized patching.
Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware, Core component) lets a low-privileged attacker with only HTTP network access compromise the entire server. Successful exploitation delivers high confidentiality, integrity, and availability impact (CVSS 3.1 8.8), effectively granting control of the WebLogic instance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Privilege escalation and data tampering in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows a low-privileged local user to compromise confidentiality and integrity of all WebLogic-accessible data when a separate user is tricked into interacting with attacker-supplied content. The scope-changed nature means impact extends beyond WebLogic to additional products in the environment. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote code execution in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP access to fully take over the server, per Oracle's June 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects full confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Authenticated remote takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 via the Console component allows a low-privileged attacker with HTTP network access to fully compromise the server. Oracle rates the flaw CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. The advisory was published in Oracle's June 2026 Critical Patch Update, making this a priority patching item for enterprise middleware operators.
Server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Console component) allows a remote unauthenticated attacker who can lure an authenticated user into interacting with a crafted HTTP request to fully compromise the server with a scope change to other products. CVSS 8.3 reflects high impact tempered by high attack complexity and required user interaction; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an unauthenticated network attacker to fully compromise the server with a scope change that impacts adjacent products. The CVSS 3.1 base score of 10.0 reflects the worst-case combination of network reachability, low complexity, no privileges, and full CIA impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) is possible by unauthenticated attackers with TCP network access to the Core component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and characterizes it as 'easily exploitable,' though no public exploit identified at time of analysis. The flaw is disclosed via the Oracle Critical Patch Update for June 2026 and currently shows no CISA KEV listing or EPSS data.
Authenticated takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is achievable through the administrative Console component, where a low-privileged HTTP-authenticated attacker can fully compromise confidentiality, integrity, and availability of the server. Oracle reports the issue as easily exploitable and rates it CVSS 8.8, though no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV. The flaw poses a significant risk to enterprise Java EE deployments where the WebLogic Console is reachable by any authenticated user.
Authenticated takeover of Oracle WebLogic Server (Fusion Middleware Core component) is possible by a high-privileged attacker over HTTP, with a scope change that can impact additional products beyond WebLogic itself. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a CVSS 3.1 base score of 9.1. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated remote takeover in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows network attackers to fully compromise the server over HTTP with no user interaction, earning the maximum CVSS 10.0 due to a scope change that can impact adjacent products. Oracle's June 2026 Critical Patch Update is the sole intelligence source; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by a low-privileged attacker over HTTP, with a CVSS 3.1 score of 9.9 driven by a scope change that lets the impact spread beyond WebLogic itself. Oracle has issued the fix in the June 2026 Critical Patch Update (cspujun2026), and there is no public exploit identified at time of analysis. Authenticated but low-effort exploitation combined with full confidentiality, integrity and availability impact makes this a top-priority patching item for any Oracle middleware estate.
Full takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is achievable by remote unauthenticated attackers via the Console component over HTTPS, provided a victim performs an action such as clicking a malicious link. The flaw carries a CVSS 3.1 base score of 8.8 with high impact across confidentiality, integrity, and availability, but exploitation hinges on user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Cross-scope data compromise in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged remote attacker over HTTPS to read, create, modify, or delete critical data through the administration Console, provided a separate user is induced to perform an action. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact with scope change reaching beyond WebLogic itself, and no public exploit identified at time of analysis.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, massively exploited for cryptocurrency mining and botnet recruitment from 2017 onward.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.2%.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.
Full server takeover is possible in Oracle WebLogic Server's Console component, affecting versions 14.1.2.0.0 and 15.1.1.0.0 via HTTP over a network. Exploitation requires a high-privileged attacker and high attack complexity, limiting the realistic threat surface to scenarios where administrative credentials are already compromised or an insider threat is present. No public exploit code and no CISA KEV listing have been identified at the time of analysis; this was disclosed as part of Oracle's Critical Patch Update (CPU) for June 2026.
Unauthenticated information disclosure in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 lets a remote attacker who can reach the HTTP listener read a subset of data that the server can access, with the Core component of Oracle Fusion Middleware as the affected surface and a CVSS 3.1 base score of 5.3 (C:L, no integrity or availability impact). Exploitation requires no credentials, no user interaction and low complexity (AV:N/AC:L/PR:N/UI:N), but the payoff is bounded to partial confidentiality loss. No public exploit code has been identified at time of analysis and EPSS is 0.26% (17th percentile), so signals point to a real but moderate-priority issue rather than a critical emergency.
Unauthenticated denial of service in Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0 allows a remote attacker with network access over HTTP/2 to hang or repeatedly crash the server through the Core component, yielding a complete denial of service with no confidentiality or integrity impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack requires only that an HTTP/2-capable listener be reachable; per the assessed vector, no authentication, privileges, or user interaction are needed. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), suggesting exploitation is not currently widespread, though the low attack complexity keeps it a realistic availability risk for internet-facing or broadly reachable instances.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Rated medium severity (CVSS 5.2).
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
org.cyberneko.html is an html parser written in Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has...
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 by exploiting an authentication bypass in the Web Container component reachable over HTTP. The vulnerability carries a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning no credentials, user interaction, or special preconditions are required beyond network reachability to the WebLogic HTTP listener; the Scope:Changed rating indicates successful exploitation can also compromise additional products beyond WebLogic itself. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), but the trivial attack preconditions and maximum severity rating make this a top-priority patch target for any internet-exposed deployment.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable through its T3 and IIOP protocol listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Classified as CWE-287 (Improper Authentication) and scored CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw allows any network-reachable attacker - no credentials, no user interaction - to gain full confidentiality, integrity, and availability impact over the affected server, which Oracle itself rates 'easily exploitable'. Exploitation hinges on reachability of the T3/IIOP listeners, which are enabled by default on the WebLogic administration and managed-server listen ports, meaning most standard deployments are exposed unless those protocols are filtered, disabled, or network-segmented; no public exploit code or confirmed in-the-wild activity was identified at time of analysis, so exposure should be treated as high-impact and high-priority but not yet observed as actively exploited.
Authentication bypass in Oracle WebLogic Server (Core component) allows unauthenticated, network-positioned attackers to gain full takeover of the server, earning the maximum CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with complete confidentiality, integrity, and availability impact. All four supported branches are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation requires reachability of the T3 or IIOP protocol listener (commonly port 7001) with no authentication and no user interaction, and no public exploit code has been identified at time of analysis; the CVE is not listed in CISA KEV, so exposure is primarily governed by whether T3/IIOP is reachable from untrusted networks.
Unauthenticated remote takeover of Oracle WebLogic Server is achievable via the T3 and IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, where an improper-authentication defect (CWE-287) in the Core component of Oracle Fusion Middleware lets a network attacker bypass login and obtain full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The only real precondition is reachability of the T3/IIOP listener, which is enabled by default and usually shares the WebLogic HTTP port (7001); no credentials and no user interaction are required, so environments that firewall, disable, or connection-filter T3/IIOP materially reduce exposure. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but this is a genuine high-priority vulnerability rather than a CVSS-inflated one.
Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware, WLS Core Components) allows a network attacker to fully take over the server via the RMI protocol. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, with a CVSS 3.1 base score of 9.8 reflecting full confidentiality, integrity, and availability loss. No public exploit was identified at time of analysis, but the 'easily exploitable' rating and unauthenticated RMI attack surface make this a top-priority patch.
Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Full server takeover in Oracle WebLogic Server Core component is achievable by unauthenticated remote attackers via the T3 and IIOP protocols, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the targeted server instance. No public exploit has been identified at time of analysis, and exploitation is constrained by high attack complexity; however, WebLogic's T3/IIOP surface has a well-established history of critical deserialization exploits that warrants prioritized patching.
Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). This is addressed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware, Core component) lets a low-privileged attacker with only HTTP network access compromise the entire server. Successful exploitation delivers high confidentiality, integrity, and availability impact (CVSS 3.1 8.8), effectively granting control of the WebLogic instance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Privilege escalation and data tampering in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows a low-privileged local user to compromise confidentiality and integrity of all WebLogic-accessible data when a separate user is tricked into interacting with attacker-supplied content. The scope-changed nature means impact extends beyond WebLogic to additional products in the environment. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authenticated remote code execution in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP access to fully take over the server, per Oracle's June 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects full confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.
Authenticated remote takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 via the Console component allows a low-privileged attacker with HTTP network access to fully compromise the server. Oracle rates the flaw CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. The advisory was published in Oracle's June 2026 Critical Patch Update, making this a priority patching item for enterprise middleware operators.
Server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Console component) allows a remote unauthenticated attacker who can lure an authenticated user into interacting with a crafted HTTP request to fully compromise the server with a scope change to other products. CVSS 8.3 reflects high impact tempered by high attack complexity and required user interaction; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an unauthenticated network attacker to fully compromise the server with a scope change that impacts adjacent products. The CVSS 3.1 base score of 10.0 reflects the worst-case combination of network reachability, low complexity, no privileges, and full CIA impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Remote takeover of Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) is possible by unauthenticated attackers with TCP network access to the Core component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and characterizes it as 'easily exploitable,' though no public exploit identified at time of analysis. The flaw is disclosed via the Oracle Critical Patch Update for June 2026 and currently shows no CISA KEV listing or EPSS data.
Authenticated takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is achievable through the administrative Console component, where a low-privileged HTTP-authenticated attacker can fully compromise confidentiality, integrity, and availability of the server. Oracle reports the issue as easily exploitable and rates it CVSS 8.8, though no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV. The flaw poses a significant risk to enterprise Java EE deployments where the WebLogic Console is reachable by any authenticated user.
Authenticated takeover of Oracle WebLogic Server (Fusion Middleware Core component) is possible by a high-privileged attacker over HTTP, with a scope change that can impact additional products beyond WebLogic itself. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a CVSS 3.1 base score of 9.1. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated remote takeover in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows network attackers to fully compromise the server over HTTP with no user interaction, earning the maximum CVSS 10.0 due to a scope change that can impact adjacent products. Oracle's June 2026 Critical Patch Update is the sole intelligence source; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by a low-privileged attacker over HTTP, with a CVSS 3.1 score of 9.9 driven by a scope change that lets the impact spread beyond WebLogic itself. Oracle has issued the fix in the June 2026 Critical Patch Update (cspujun2026), and there is no public exploit identified at time of analysis. Authenticated but low-effort exploitation combined with full confidentiality, integrity and availability impact makes this a top-priority patching item for any Oracle middleware estate.
Full takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is achievable by remote unauthenticated attackers via the Console component over HTTPS, provided a victim performs an action such as clicking a malicious link. The flaw carries a CVSS 3.1 base score of 8.8 with high impact across confidentiality, integrity, and availability, but exploitation hinges on user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Cross-scope data compromise in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged remote attacker over HTTPS to read, create, modify, or delete critical data through the administration Console, provided a separate user is induced to perform an action. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact with scope change reaching beyond WebLogic itself, and no public exploit identified at time of analysis.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, massively exploited for cryptocurrency mining and botnet recruitment from 2017 onward.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 91.2%.
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 94.0%.
Full server takeover is possible in Oracle WebLogic Server's Console component, affecting versions 14.1.2.0.0 and 15.1.1.0.0 via HTTP over a network. Exploitation requires a high-privileged attacker and high attack complexity, limiting the realistic threat surface to scenarios where administrative credentials are already compromised or an insider threat is present. No public exploit code and no CISA KEV listing have been identified at the time of analysis; this was disclosed as part of Oracle's Critical Patch Update (CPU) for June 2026.
Unauthenticated information disclosure in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 lets a remote attacker who can reach the HTTP listener read a subset of data that the server can access, with the Core component of Oracle Fusion Middleware as the affected surface and a CVSS 3.1 base score of 5.3 (C:L, no integrity or availability impact). Exploitation requires no credentials, no user interaction and low complexity (AV:N/AC:L/PR:N/UI:N), but the payoff is bounded to partial confidentiality loss. No public exploit code has been identified at time of analysis and EPSS is 0.26% (17th percentile), so signals point to a real but moderate-priority issue rather than a critical emergency.
Unauthenticated denial of service in Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0 allows a remote attacker with network access over HTTP/2 to hang or repeatedly crash the server through the Core component, yielding a complete denial of service with no confidentiality or integrity impact (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack requires only that an HTTP/2-capable listener be reachable; per the assessed vector, no authentication, privileges, or user interaction are needed. There is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS is low at 0.40% (32nd percentile), suggesting exploitation is not currently widespread, though the low attack complexity keeps it a realistic availability risk for internet-facing or broadly reachable instances.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Rated medium severity (CVSS 5.2).
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
org.cyberneko.html is an html parser written in Java. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has...