Oracle WebLogic Server Faces Critical Unauthenticated Data Manipulation Flaw
A new critical vulnerability in Oracle WebLogic Server allows unauthenticated attackers to compromise data via HTTP without any user interaction.
Key points
- CVE-2026-87302 is rated Critical with a CVSS score of 9.1.
- The flaw affects WebLogic Server versions 12.2.1.4.0 through 15.1.1.0.0.
- Attackers can create, delete, or modify critical data without authentication.
The National Vulnerability Database has recorded a new critical security flaw in Oracle WebLogic Server, identified as CVE-2026-87302. This vulnerability resides within the Core component of the Oracle Fusion Middleware product suite and poses a significant risk to organizations relying on this enterprise application server.
According to the NVD record, the issue carries a CVSS 3.1 Base Score of 9.1, which classifies it as Critical. The vulnerability is described as easily exploitable, allowing an unauthenticated attacker with network access via HTTP to compromise the server. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data.
Technical Details and Impact
The CVSS vector for CVE-2026-87302 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This vector indicates that the attack vector is Network, meaning the flaw can be exploited remotely over the internet. The Attack Complexity is Low, and no Privileges or User Interaction are required, making it accessible to a broad range of potential attackers.
The impact on Confidentiality and Integrity is rated as High. This means an attacker can access critical data or gain complete access to all Oracle WebLogic Server accessible data. The Availability impact is rated as None, suggesting the flaw primarily targets data integrity and confidentiality rather than causing service outages directly.
Affected Versions
The vulnerability affects specific supported versions of Oracle WebLogic Server. Organizations running any of the following versions are considered affected according to the NVD entry. These versions are part of the Oracle Fusion Middleware ecosystem.
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
Administrators should verify their current server versions immediately to determine if their infrastructure falls within this affected range. The NVD record does not specify earlier or later versions as affected, limiting the scope to these four specific releases.
What should you do?
Security teams should audit their environments for the presence of the affected WebLogic Server versions. Since the flaw allows unauthenticated remote access via HTTP, restricting network access to these servers is a critical immediate step. Organizations should monitor for any official patches from Oracle.
What to do and how to stay safe: Oracle
- Verify if your organization runs WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Restrict HTTP access to WebLogic Server instances to trusted networks only, as the flaw is exploitable over the network.
- Monitor Oracle’s security alerts for a confirmed patch or mitigation guidance for CVE-2026-87302.
- Review server logs for unusual HTTP traffic that may indicate exploitation attempts.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-87302?
The CVSS 3.1 Base Score is 9.1, which is classified as Critical.
Which Oracle WebLogic Server versions are affected?
Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected.
Does the vulnerability require authentication?
No, the vulnerability allows an unauthenticated attacker to exploit the flaw via HTTP.
