CVE-2026-87300 in Weblogic Server Proxy Plug-in
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle WebLogic Server Proxy Plug-in, a critical component of the Oracle Fusion Middleware suite designed to facilitate communication between third-party web servers and the core WebLogic application server. This security flaw affects specific supported versions including 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The nature of this vulnerability is characterized by its difficulty to exploit, which suggests that while the underlying technical mechanism may be complex or require specific conditions to trigger, it remains a significant threat due to its potential for widespread impact across interconnected systems.
From a technical perspective, the flaw allows an unauthenticated attacker with network access via HTTP to compromise the integrity and confidentiality of the proxy plug-in environment. Although the vulnerability is technically located within the Proxy Plug-In component, Oracle has noted that successful exploitation can lead to a scope change, meaning attacks may significantly impact additional products beyond just the plug-in itself. This lateral movement capability indicates that the flaw likely involves improper validation or handling of HTTP requests that allows an attacker to manipulate data flows between the web server and the application server, potentially bypassing standard authentication mechanisms due to the unauthenticated nature of the initial access vector.
The operational impact of this vulnerability is severe, classified with a CVSS 3.1 Base Score of 8.7, indicating a High severity level. The primary impacts are on Confidentiality and Integrity, as denoted by the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Successful exploitation enables unauthorized creation, deletion, or modification of critical data accessible to the Oracle WebLogic Server Proxy Plug-in. Furthermore, it grants attackers the ability to access sensitive information that would otherwise be protected, effectively leading to a complete compromise of all data handled by this component. The high confidentiality and integrity impacts underscore the risk of data exfiltration and malicious data manipulation without detection or authorization.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 (Improper Authentication) due to the unauthenticated access vector, and potentially CWE-352 (Cross-Site Request Forgery) or CWE-918 (Server Side Request Forgery) depending on the specific mechanism used to exploit the HTTP-based flaw. The attack pattern corresponds to MITRE ATT&CK techniques involving Initial Access via Web Applications, specifically leveraging misconfigurations or vulnerabilities in web-facing components to gain a foothold within the network infrastructure.
Mitigation strategies should prioritize immediate patching of all affected Oracle Fusion Middleware versions to their latest security update releases provided by Oracle. Organizations must also implement strict access controls on HTTP ports associated with these services, ensuring that only authorized IP ranges can communicate with the proxy plug-in interfaces. Network segmentation is recommended to isolate WebLogic components from direct internet exposure where possible. Additionally, deploying a Web Application Firewall (WAF) configured to detect and block anomalous HTTP requests targeting known vulnerable endpoints can provide an additional layer of defense against exploitation attempts while patching efforts are underway.