Key points
- Oracle WebLogic Server versions 12.2.1.4.0 through 15.1.1.0.0 contain a critical vulnerability.
- Attackers need only network access via HTTP to exploit the flaw without authentication.
- Successful exploitation allows unauthorized creation, deletion, or modification of critical server data.
Remote attackers can now access and manipulate critical data on Oracle WebLogic Server installations without providing any login credentials. This capability grants them complete control over accessible information, allowing them to read, alter, or delete records at will. The vulnerability affects core components of the Oracle Fusion Middleware product, specifically impacting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The ease of exploitation means that any system exposed to the internet is at immediate risk.
In plain English
The vulnerability is located in the Core component of the Oracle WebLogic Server product. It allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful attacks result in unauthorized creation, deletion, or modification of critical data. It also permits unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. The flaw is described as easily exploitable, meaning it requires low complexity for an attacker to succeed.
The background
The National Vulnerability Database rates this issue as critical, assigning it a CVSS score of 9.1. This high score reflects the severe impact on both data confidentiality and integrity. The vulnerability is classified as easily exploitable, requiring low complexity for an attacker to succeed. No user interaction is needed for the attack to work. The flaw allows for unauthorised access to all data the server can reach, making it a significant threat to organisations relying on this middleware for critical operations.
What changes now
Organisations running the affected versions must treat this as an urgent priority. The source material does not state whether a patch or fix has been released. Teams should verify which versions of Oracle WebLogic Server are currently deployed across their infrastructure. Any instance running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 is vulnerable. Until a fix is provided by the vendor, reducing network exposure to these systems is the only viable defensive measure.
The attacker's path
Teams usually begin by scanning for exposed web services that accept unauthenticated requests. In this scenario, the attacker targets the HTTP interface directly, looking for endpoints that process data without verifying identity. This stage serves as the initial foothold, allowing the intruder to map the system's capabilities. By sending crafted requests, they test whether the server accepts modifications or data retrieval commands. The goal is to confirm that the application logic bypasses standard access controls, enabling further data exfiltration or manipulation without triggering alerts.
Background: Unauthorized access
Disconnect affected devices from the network immediately to stop data exfiltration. Preserve system logs and memory states before restarting. Identify the entry point and revoke compromised credentials. Notify relevant stakeholders using your incident communication plan. Restore systems from verified clean backups.
Read the full guide: Unauthorized Access Response: Containment, Recovery and Prevention Steps
What to do and how to stay safe: Oracle WebLogic Server
- Restrict network access to WebLogic Server management interfaces to trusted IP addresses only.
- Monitor server logs for unusual HTTP requests that originate from untrusted sources.
- Implement web application firewalls to block suspicious traffic patterns targeting core components.
- Verify that all instances are updated to versions that are not listed as affected.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Oracle WebLogic Server are affected by CVE-2026-87302?
Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected.
Is authentication required to exploit this vulnerability?
No, the vulnerability allows unauthenticated attackers to exploit the flaw.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates it as critical with a CVSS score of 9.1.
