How do I check whether I am affected by CVE-2026-83379?

Check whether the WebLogic Server Proxy Plug-in for third-party web servers (Apache HTTP Server, IIS, Oracle HTTP Server) is installed in front of WebLogic: look for the mod_wl / mod_wl_ohs module or plug-in directory in the web server config and confirm its version is 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0. Then run 'opatch lspatches' in the plug-in's Oracle home and compare against the October 2026 CPU patch in the Fusion Middleware Patch Availability Document.

What is the fix for CVE-2026-83379?

Apply the Oracle October 2026 CPU patch for the WebLogic Server Proxy Plug-in; get the patch number for your version and platform from the Patch Availability Document on My Oracle Support. Fixed build number is unknown from public sources. Until patched, restrict network access to the proxying web server to trusted ranges.

Who is not affected by CVE-2026-83379?

Not affected if: no-weblogic-proxy-plugin, other-versions, plug-in-not-installed.

Live › vulnerability › CVE-2026-83379

Go to dashboard

high8.7Vendor

Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data

The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. Successful attacks can create, change, or delete critical data and read data the plug-in can access, with impact spreading to other products.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.7

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads and modifies critical data without logging in.
CVSS said: 8.7. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-83379

Go to dashboard

high8.7Vendor

Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.7

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads and modifies critical data without logging in.
CVSS said: 8.7. The facts above say critical; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources