{"id":"CVE-2026-83379","kind":"vulnerability","aliases":["CVE-2026-83379"],"related":[],"title":"Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","summary":"The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. Successful attacks can create, change, or delete critical data and read data the plug-in can access, with impact spreading to other products.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle WebLogic Server Proxy Plug-in","fixed":[],"affected":"12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","self-hosted","vendor","web-server-proxy","weblogic"],"not_affected_if":["no-weblogic-proxy-plugin","other-versions","plug-in-not-installed"],"how_to_check":"Check whether the WebLogic Server Proxy Plug-in for third-party web servers (Apache HTTP Server, IIS, Oracle HTTP Server) is installed in front of WebLogic: look for the mod_wl / mod_wl_ohs module or plug-in directory in the web server config and confirm its version is 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0. Then run 'opatch lspatches' in the plug-in's Oracle home and compare against the October 2026 CPU patch in the Fusion Middleware Patch Availability Document.","fix":"Apply the Oracle October 2026 CPU patch for the WebLogic Server Proxy Plug-in; get the patch number for your version and platform from the Patch Availability Document on My Oracle Support. Fixed build number is unknown from public sources. Until patched, restrict network access to the proxying web server to trusted ranges.","status":"open","published_at":"2026-10-20T22:19:54+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:37:09+00:00","updated_at":"2026-10-24T00:02:40+00:00","category":"vendor","confidence":0.65,"triage":{"at":"2026-10-23T22:37:09Z","model":"claude-haiku-5-5","output":{"fix":"Move to a patched release of the WebLogic Server Proxy Plug-in; the sources do not name the fixed build. Check the Oracle Critical Patch Update advisory for the fixed version.","reach":"internet","title":"Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data","impact":"high","summary":"The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. Successful attacks can create, change, or delete critical data and read data the plug-in can access, with impact spreading to other products.","category":"vendor","who_cares":["weblogic","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies critical data without logging in","analyst_note":"Find the Oracle CPU advisory for CVE-2026-83379 to get the patched plug-in version and whether the affected web server configurations are default; the NVD entry alone does not give those.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-weblogic-proxy-plugin"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000548,"input_tokens":3244,"output_tokens":448,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory for CVE-2026-83379 to get the patched plug-in version and whether the affected web server configurations are default; the NVD entry alone does not give those.","search":"'-2026':17A,20A '-83379':18A,21A '/av':235C '12.2.1.4.0':127C '14.1.1.0.0':128C '14.1.2.0.0':130C '3.1':223C,234C '8.7':226C 'access':86B,140C,185C,198C,204C,210C,220C 'addit':168C 'affect':125C 'allow':135C 'attack':11A,61B,70B,137C,164C,173C 'base':224C 'c/c':240C 'chang':14A,73B,171C 'complet':209C 'compon':108C 'compromis':144C 'confidenti':227C 'creat':72B 'creation':181C 'critic':76B,187C,206C 'cve':16A,19A 'cvss':222C,231C,233C 'data':15A,77B,80B,188C,199C,207C,221C 'delet':75B,182C 'difficult':131C 'exploit':133C 'flaw':7A,57B 'fusion':31B,106C 'h/a':242C 'h/i':241C 'h/pr':237C 'host':35B 'http':10A,65B,142C 'impact':88B,167C,230C 'in':28A 'integr':229C 'let':8A 'log':67B 'may':165C 'middlewar':32B,107C 'modif':184C 'n':243C 'n/ac':236C 'n/s':239C 'n/ui':238C 'network':139C 'oracl':1A,30B,96C,105C,145C,157C,191C,213C 'oracle':22A 'oracle-fusion-middlewar':29B 'parti':52B,118C 'plug':5A,27A,47B,83B,101C,113C,150C,162C,196C,218C 'plug-in':4A,26A,46B,82B,100C,112C,149C,161C,195C,217C 'product':92B,103C,169C 'proxi':3A,40B,45B,99C,111C,148C,160C,194C,216C 'proxy':25A 'reach':63B 'read':12A,79B 'remot':60B 'result':178C 'scope':170C 'score':225C 'self':34B 'self-host':33B 'server':24A,39B,44B,54B,98C,110C,120C,147C,159C,193C,215C 'signific':166C 'spread':89B 'success':69B,172C 'support':121C 'third':51B,117C 'third-parti':50B,116C 'unauthent':9A,136C 'unauthor':180C,203C 'vector':232C 'vendor':36B 'version':122C 'via':141C 'vulner':93C,134C,154C,176C 'web':38B,53B,119C 'web-server-proxi':37B 'weblog':2A,41B,43B,97C,109C,146C,158C,192C,214C 'weblogic':23A 'well':201C 'without':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83379","severity":null,"published_at":"2026-10-20T22:19:54+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83379:576","url":null,"severity":null,"published_at":"2026-10-24T00:02:40+00:00","modified_at":"2026-10-24T00:02:40+00:00","first_seen_at":"2026-10-24T00:02:40+00:00","fetched_at":"2026-10-24T00:02:40+00:00","note":"Fixed in Oracle October 2026 CPU (cpuoct2026, 2026-10-20); plug-in patch number/fixed build is only in My Oracle Support Patch Availability Doc (login), not public. Affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 per CVE record/Armis (CERT-FR lists only 12.2.1.4.0 and 14.1.2.0.0, discrepancy). Not exploited, no public PoC found. Same description as sibling CVE-2026-87300 (possible duplicate, code decides). Did not search social posts. Default-config question not answered by public sources."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2319,"url":"https://cve.armis.com/CVE-2026-83379","title":"CVE-2026-83379 | Armis","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}