CVE-2026-87302 in WebLogic Server
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Core component of Oracle WebLogic Server, a widely deployed enterprise application server used to host Java-based applications and services. This flaw affects multiple supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The nature of the vulnerability is particularly severe because it allows for exploitation by an unauthenticated attacker who requires only network access via HTTP to initiate a successful attack vector. This lack of authentication requirement significantly lowers the barrier to entry for malicious actors, enabling remote code execution or data manipulation without prior credentials.
From a technical perspective, this flaw represents a critical failure in input validation and access control mechanisms within the WebLogic Server core processing logic. The vulnerability likely stems from improper handling of specific HTTP requests that bypass security checks designed to restrict unauthorized operations. Because the attack surface is exposed over standard web protocols, it can be triggered remotely across network boundaries without user interaction or social engineering prerequisites. This aligns with common patterns found in CWE-20 Improper Input Validation and CWE-862 Missing Authorization, where the system fails to properly verify that a request originates from an authorized source before executing sensitive administrative functions.
The operational impact of this vulnerability is substantial, as indicated by its CVSS 3.1 Base Score of 9.1, which classifies it as Critical severity based on high confidentiality and integrity impacts while maintaining low availability impact in the base score calculation. Successful exploitation grants an attacker unauthorized capabilities to create, delete, or modify critical data stored within the server environment. Furthermore, it permits complete access to all Oracle WebLogic Server accessible data, effectively compromising the entire information asset managed by the application server. This level of compromise can lead to significant business disruption, regulatory non-compliance due to data breaches, and potential lateral movement into other parts of the network infrastructure if the compromised server serves as a pivot point.
In terms of threat modeling, this vulnerability maps directly to MITRE ATT&CK techniques involving Remote Code Execution and Data Exfiltration. Attackers can leverage this flaw to inject malicious payloads or extract sensitive information such as customer records, financial data, or intellectual property protected by the application server. The ability to modify critical data also introduces risks related to integrity violations, where attackers could alter configuration files, database entries, or application logic to maintain persistence or disrupt services intentionally.
Mitigation strategies must prioritize immediate patching of all affected WebLogic Server versions with the latest security updates provided by Oracle. Organizations should implement network-level controls such as web application firewalls that can detect and block exploit patterns associated with this vulnerability before they reach the server. Additionally, restricting HTTP access to only trusted IP ranges through firewall rules or reverse proxy configurations can reduce the attack surface significantly until patches are applied. Regular auditing of administrative interfaces and enforcing strict authentication policies for all management endpoints further hardens the environment against similar unauthenticated exploitation attempts.