Oracle WebLogic Server Has Critical Vulnerability Allowing Remote Takeover
An unauthenticated flaw in Oracle WebLogic Server carries a 9.8 CVSS score, enabling full server compromise via HTTP.
Key points
- CVE-2026-91323 affects four specific versions of Oracle WebLogic Server within the Fusion Middleware suite.
- The flaw allows unauthenticated attackers with network access to take over the server through HTTP requests.
- The National Vulnerability Database rates the vulnerability as critical with a CVSS 3.1 base score of 9.8.
A critical security flaw in Oracle WebLogic Server now permits unauthenticated attackers to seize full control of affected systems. The vulnerability, identified as CVE-2026-91323, enables remote compromise via standard HTTP connections without requiring any credentials from the attacker.
The National Vulnerability Database lists the issue with a CVSS 3.1 base score of 9.8, marking it as critical. Attackers need only network access to exploit the weakness. Successful exploitation results in complete takeover of the Oracle WebLogic Server, impacting confidentiality, integrity, and availability equally according to the vector string.
Technical Scope and Impact
The defect resides in the Core component of the Oracle WebLogic Server product, which is part of the broader Oracle Fusion Middleware family. The vulnerability is described as easily exploitable due to its low attack complexity and lack of privilege requirements.
Security researchers note that no user interaction is necessary for the exploit to succeed. The CVSS vector indicates that the attack vector is network-based, with no special conditions required for access. This means any system reachable over the internet or an internal network is potentially at risk if it runs an affected version.
Affected Software Versions
Four specific versions of Oracle WebLogic Server are confirmed to be vulnerable to this flaw. Organizations using version 12.2.1.4.0 should verify their exposure immediately. The same caution applies to environments running version 14.1.1.0.0.
Users of version 14.1.2.0.0 are also affected by this critical vulnerability. Additionally, systems deployed with version 15.1.1.0.0 remain susceptible to remote takeover attempts. No other versions are currently listed as affected in the available records.
What should you do?
Security teams should immediately audit their infrastructure to identify any instances of the four affected WebLogic Server versions. If vulnerable systems are detected, they should be isolated from untrusted networks until a mitigation is available. Monitor server logs for unusual HTTP traffic patterns that may indicate exploitation attempts.
What to do and how to stay safe: Oracle
- Inventory all servers to determine if any are running WebLogic versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Restrict network access to WebLogic Server instances so that only trusted internal IPs can reach the HTTP ports.
- Monitor access logs for spikes in unauthenticated requests or unusual payloads targeting the WebLogic console or services.
- Prepare to apply security updates or patches once the vendor releases them for the affected components.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-91323?
The vulnerability has a CVSS 3.1 base score of 9.8, which is rated as critical.
Which Oracle WebLogic Server versions are affected?
Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected.
Does exploiting this vulnerability require authentication?
No, the vulnerability allows unauthenticated attackers to compromise the server.
