{"id":"CVE-2026-83399","kind":"vulnerability","aliases":["CVE-2026-83399"],"related":[],"title":"Oracle WebLogic Server: unauthenticated network flaw allows full server takeover","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Unauthenticated remote takeover of WebLogic Server Core via T3 or IIOP (CVSS 9.8, CWE-306). Affects 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0. Fixed by the October 2026 Critical Patch Update. No known exploitation or public PoC yet, but WebLogic T3/IIOP bugs are historically weaponized quickly.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle WebLogic Server","fixed":["October 2026 CPU PSU 40069416 (12.2.1.4.0)","40069954 (14.1.1.0.0)","40058371 (14.1.2.0.0)","40050052 (15.1.1.0.0)"],"affected":"12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["iiop","java","oracle","runtime","self-hosted","t3","weblogic"],"not_affected_if":["not-network-reachable","t3-iiop-blocked","unknown"],"how_to_check":"Run 'java weblogic.version' or opatch lspatches in the WebLogic ORACLE_HOME and compare with the October 2026 PSU. Check whether T3/IIOP ports (default 7001/7002) are reachable from untrusted networks.","fix":"Apply the Oct 2026 PSU: 12.2.1.4.0 -> 40069416; 14.1.1.0.0 -> 40069954; 14.1.2.0.0 -> 40058371; 15.1.1.0.0 -> 40050052 (PSU numbers per Rapid7). Until then block T3 and IIOP from untrusted networks (e.g. connection filter on the domain); test first, it may break remote clients.","status":"open","published_at":"2026-10-20T22:19:56+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:43+00:00","updated_at":"2026-10-23T23:03:48+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T22:34:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle WebLogic Server: unauthenticated network flaw allows full server takeover","impact":"high","summary":"Oracle WebLogic Server Core is affected in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access over T3 or IIOP can take over the server.","category":"runtime","who_cares":["java","weblogic","oracle","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the WebLogic server remotely without any credentials","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched versions and whether T3/IIOP exposure must be enabled for this flaw to apply.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000491,"input_tokens":3103,"output_tokens":362,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patched versions and whether T3/IIOP exposure must be enabled for this flaw to apply.","search":"'-2026':12A,15A '-306':43B '-83399':13A,16A '/av':140C '12.2.1.4.0':45B,91C '14.1.1.0.0':46B,92C '14.1.2.0.0':47B,93C '15.1.1.0.0':48B,95C '2026':53B '3.1':127C,139C '9.8':41B,130C 'access':104C 'affect':44B,89C 'allow':7A,99C 'attack':101C,114C 'avail':134C 'base':128C 'bug':67B 'compon':83C 'compromis':109C 'confidenti':131C 'core':35B,84C 'critic':54B 'cve':11A,14A 'cvss':40B,126C,136C,138C 'cwe':42B 'easili':96C 'exploit':59B,97C 'fix':49B 'flaw':6A 'full':8A 'fusion':81C 'h':148C 'h/a':147C 'h/i':146C 'histor':69B 'host':26B 'iiop':20B,39B,107C 'impact':135C 'integr':132C 'java':21B 'known':58B 'l/pr':142C 'middlewar':82C 'n/ac':141C 'n/s':144C 'n/ui':143C 'network':5A,103C 'octob':52B 'oracl':1A,22B,75C,80C,110C,123C 'oracle':17A 'patch':55B 'poc':62B 'product':78C 'public':61B 'quick':71B 'remot':30B 'result':119C 'runtim':23B 'score':129C 'self':25B 'self-host':24B 'server':3A,9A,19A,34B,77C,112C,125C 'success':113C 'support':85C 't3':27B,37B,106C 't3/iiop':66B 'takeov':10A,31B,121C 'u/c':145C 'unauthent':4A,29B,100C 'updat':56B 'vector':137C 'version':86C 'via':36B,105C 'vulner':72C,98C,117C 'weapon':70B 'weblog':2A,28B,33B,65B,76C,111C,124C 'weblogic':18A 'yet':63B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83399","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83399","severity":null,"published_at":"2026-10-20T22:19:56+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83399:360","url":null,"severity":null,"published_at":"2026-10-23T23:03:48+00:00","modified_at":"2026-10-23T23:03:48+00:00","first_seen_at":"2026-10-23T23:03:48+00:00","fetched_at":"2026-10-23T23:03:48+00:00","note":"Oct 2026 CPU (Oracle page linked, WebLogic row not read directly); PSU numbers from Rapid7; workaround from CERT Santé. Not exploited, no public PoC, not in KEV. T3/IIOP is the attack path and enabled by default on the WebLogic listener; Oracle does not say it must be separately enabled."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1755,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-83399/","title":"Rapid7: Oracle WebLogic CVE-2026-83399 (PSU numbers)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1756,"url":"https://cyberveille.esante.gouv.fr/alertes/oracle-cve-2026-83399-2026-10-21","title":"CERT Santé: Oracle CVE-2026-83399","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}