CVE-2026-91323 in WebLogic Server
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Core component of Oracle WebLogic Server, a widely deployed enterprise application server used to host Java-based applications and services. This flaw affects multiple supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The severity of this issue is classified as critical with a CVSS v3.1 base score of 9.8, indicating that it poses an immediate and severe threat to the confidentiality, integrity, and availability of affected systems. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires low complexity, demands no user interaction or authentication, and results in high impact across all security triad dimensions when successful.
From a technical perspective, this vulnerability allows an unauthenticated attacker to compromise the Oracle WebLogic Server environment by exploiting flaws within its HTTP handling mechanisms. Because the exploit does not require prior authentication, it represents a significant risk for any instance of WebLogic that is exposed to network traffic without adequate perimeter controls or pre-authentication filters. The low attack complexity suggests that automated tools can readily identify and leverage this weakness against vulnerable targets. Once exploited, an attacker gains the ability to execute arbitrary code on the underlying system hosting the application server, effectively achieving full control over the environment. This level of access enables the modification of application logic, theft of sensitive data stored or processed by the server, and disruption of services provided to end-users.
The operational impact of this vulnerability is profound for organizations relying on Oracle WebLogic Server for critical business operations. A successful compromise leads directly to a complete takeover of the server, which can serve as a pivot point for further lateral movement within an enterprise network. Attackers may use the compromised instance to exfiltrate confidential intellectual property or customer data, alter transactional integrity by modifying database records through connected applications, and deny service to legitimate users by crashing processes or consuming system resources. The high availability impact underscores that this is not merely a data breach risk but also a critical infrastructure stability threat capable of causing significant downtime and operational paralysis.
In terms of industry classification standards, this vulnerability aligns with CWE-287 Improper Authentication, as it allows access without proper identity verification, and potentially CWE-94 Code Injection if the exploitation involves injecting malicious code into the server environment. From a tactical standpoint within the MITRE ATT&CK framework, this behavior corresponds to Initial Access techniques involving Exploit Public-Facing Application, specifically leveraging vulnerabilities in web servers or application platforms. The lack of authentication requirement places it firmly in the category of attacks that do not require social engineering or user interaction, making them highly scalable and dangerous for automated scanning campaigns targeting internet-facing assets.
Mitigation strategies must prioritize immediate remediation through patching to the latest available version provided by Oracle, which addresses the underlying code flaws responsible for this authentication bypass. In environments where immediate patching is not feasible due to operational constraints or testing requirements, network-level controls should be implemented to restrict access to WebLogic ports exclusively from trusted IP ranges using firewalls or web application firewalls that can inspect and filter HTTP traffic before it reaches the server. Additionally, deploying intrusion detection systems configured with signatures for this specific vulnerability can help identify attempted exploits in real-time. Organizations should also conduct a thorough audit of their external-facing assets to ensure no instances of affected versions are inadvertently exposed to the public internet without robust pre-authentication security layers such as API gateways or reverse proxies that enforce strict access policies and input validation.