---
id: "CVE-2026-83399"
kind: "vulnerability"
aliases: ["CVE-2026-83399"]
title: "Oracle WebLogic Server: unauthenticated network flaw allows full server takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle WebLogic Server", "fixed": ["October 2026 CPU PSU 40069416 (12.2.1.4.0)", "40069954 (14.1.1.0.0)", "40058371 (14.1.2.0.0)", "40050052 (15.1.1.0.0)"], "affected": "12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["iiop", "java", "oracle", "runtime", "self-hosted", "t3", "weblogic"]
not_affected_if: ["not-network-reachable", "t3-iiop-blocked", "unknown"]
published_at: "2026-10-20T22:19:56+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-23T23:03:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83399", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:03:48+00:00"}]
---

# Oracle WebLogic Server: unauthenticated network flaw allows full server takeover

Unauthenticated remote takeover of WebLogic Server Core via T3 or IIOP (CVSS 9.8, CWE-306). Affects 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0. Fixed by the October 2026 Critical Patch Update. No known exploitation or public PoC yet, but WebLogic T3/IIOP bugs are historically weaponized quickly.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle WebLogic Server affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 fixed October 2026 CPU PSU 40069416 (12.2.1.4.0), 40069954 (14.1.1.0.0), 40058371 (14.1.2.0.0), 40050052 (15.1.1.0.0)

## How to check

Run 'java weblogic.version' or opatch lspatches in the WebLogic ORACLE_HOME and compare with the October 2026 PSU. Check whether T3/IIOP ports (default 7001/7002) are reachable from untrusted networks.

## Fix

Apply the Oct 2026 PSU: 12.2.1.4.0 -> 40069416; 14.1.1.0.0 -> 40069954; 14.1.2.0.0 -> 40058371; 15.1.1.0.0 -> 40050052 (PSU numbers per Rapid7). Until then block T3 and IIOP from untrusted networks (e.g. connection filter on the domain); test first, it may break remote clients.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83399
- 2026-10-23T23:03:48+00:00 analyst — Oct 2026 CPU (Oracle page linked, WebLogic row not read directly); PSU numbers from Rapid7; workaround from CERT Santé. Not exploited, no public PoC, not in KEV. T3/IIOP is the attack path and enabled by default on the WebLogic listener; Oracle does not say it must be separately enabled.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Rapid7: Oracle WebLogic CVE-2026-83399 (PSU numbers) https://www.rapid7.com/db/vulnerabilities/cve-2026-83399/
- [mitigation] CERT Santé: Oracle CVE-2026-83399 https://cyberveille.esante.gouv.fr/alertes/oracle-cve-2026-83399-2026-10-21

## From the sources

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_