---
id: "CVE-2026-83379"
kind: "vulnerability"
aliases: ["CVE-2026-83379"]
title: "Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Oracle WebLogic Server Proxy Plug-in", "fixed": [], "affected": "12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "self-hosted", "vendor", "web-server-proxy", "weblogic"]
not_affected_if: ["no-weblogic-proxy-plugin", "other-versions", "plug-in-not-installed"]
published_at: "2026-10-20T22:19:54+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:02:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83379", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:02:40+00:00"}]
---

# Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change data

The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. Successful attacks can create, change, or delete critical data and read data the plug-in can access, with impact spreading to other products.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle WebLogic Server Proxy Plug-in affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 fixed ?

## How to check

Check whether the WebLogic Server Proxy Plug-in for third-party web servers (Apache HTTP Server, IIS, Oracle HTTP Server) is installed in front of WebLogic: look for the mod_wl / mod_wl_ohs module or plug-in directory in the web server config and confirm its version is 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0. Then run 'opatch lspatches' in the plug-in's Oracle home and compare against the October 2026 CPU patch in the Fusion Middleware Patch Availability Document.

## Fix

Apply the Oracle October 2026 CPU patch for the WebLogic Server Proxy Plug-in; get the patch number for your version and platform from the Patch Availability Document on My Oracle Support. Fixed build number is unknown from public sources. Until patched, restrict network access to the proxying web server to trusted ranges.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83379
- 2026-10-24T00:02:40+00:00 analyst — Fixed in Oracle October 2026 CPU (cpuoct2026, 2026-10-20); plug-in patch number/fixed build is only in My Oracle Support Patch Availability Doc (login), not public. Affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 per CVE record/Armis (CERT-FR lists only 12.2.1.4.0 and 14.1.2.0.0, discrepancy). Not exploited, no public PoC found. Same description as sibling CVE-2026-87300 (possible duplicate, code decides). Did not search social posts. Default-config question not answered by public sources.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- [mitigation] CVE-2026-83379 | Armis https://cve.armis.com/CVE-2026-83379

## From the sources

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_