CVE-2026-91502 in WebLogic Server
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Core component of Oracle WebLogic Server, a widely deployed enterprise application server used for building and deploying Java-based applications. The affected versions include 12.2.1.4.0 as well as the newer 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 releases of Oracle Fusion Middleware. This flaw is particularly concerning because it allows for exploitation by an unauthenticated attacker who requires only network access via the TLS protocol to initiate a successful attack vector. The presence of this vulnerability in supported versions indicates that even currently maintained software environments are susceptible, necessitating immediate attention from system administrators and security teams responsible for these infrastructure components.
From a technical perspective, the flaw enables unauthorized modifications to data accessible by Oracle WebLogic Server, including update, insert, or delete operations on specific datasets. In addition to integrity violations allowing data manipulation, the vulnerability also permits unauthorized read access to a subset of server-accessible data, leading to potential confidentiality breaches where sensitive information may be exfiltrated. Furthermore, the attacker can trigger conditions that result in a partial denial of service, disrupting normal operational capabilities and impacting system availability for legitimate users. These combined impacts on confidentiality, integrity, and availability align with high-severity risk profiles commonly associated with critical infrastructure vulnerabilities.
The severity of this issue is quantified by a CVSS 3.1 Base Score of 7.3, classified as High. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects an attack complexity that is low, requiring no user interaction and no prior authentication privileges. While the scope remains unchanged at U, indicating the impact is confined to the vulnerable component rather than escalating to other security boundaries, the simultaneous compromise of all three core security pillars underscores the critical nature of the threat. This profile suggests that automated scanning tools or opportunistic attackers could easily identify and exploit this weakness across networks where WebLogic servers are exposed without adequate perimeter defenses.
In terms of industry standard classifications, this vulnerability exhibits characteristics consistent with CWE-94 Improper Control of Generation of Code Command Injection if code execution is involved in the data manipulation process, or more broadly CWE-200 Exposure of Sensitive Information to an Unauthorized Actor for the read access aspects and CWE-787 Out-of-bounds Write or similar memory corruption issues if the denial of service stems from resource exhaustion due to malformed inputs. From a tactical standpoint within the MITRE ATT&CK framework, this vulnerability facilitates initial access through network services and enables actions corresponding to Data Exfiltration over C2 channels for reading data, as well as Impact techniques such as Service Stop or Resource Hijacking for the denial of service component. The lack of authentication requirement places it firmly in the category of remote code execution or server-side request forgery variants that do not require valid credentials.
To mitigate this risk, organizations must prioritize patching Oracle WebLogic Server to a version where the vulnerability has been resolved by consulting the latest security bulletins from Oracle. Until patches are applied, network segmentation strategies should be implemented to restrict access to WebLogic ports strictly to trusted IP ranges using firewalls or reverse proxies with strict ACLs. Additionally, enabling TLS inspection and deep packet analysis can help detect anomalous traffic patterns indicative of exploitation attempts. Security teams should also audit existing deployments for exposed instances that lack proper authentication mechanisms on administrative consoles or internal APIs, ensuring that defense-in-depth measures are in place to compensate for the underlying software flaw while updates are being deployed across the enterprise environment.