{"id":"CVE-2026-87300","kind":"vulnerability","aliases":["CVE-2026-87300"],"related":[],"title":"Oracle WebLogic proxy plug-in flaw lets unauthenticated remote attackers compromise data","description":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","summary":"The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. A successful attack can create, change, or delete critical data and read data the plug-in can access, and it can affect other products as well.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle WebLogic Server Proxy Plug-in","fixed":[],"affected":"12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","runtime","self-hosted","web-server-proxy","weblogic"],"not_affected_if":["other-versions","plug-in-not-installed"],"how_to_check":"Find out whether the WebLogic Server Proxy Plug-in for third-party web servers (Apache HTTP Server, IIS, etc.) is installed in front of WebLogic and which version it is. Look for the mod_wl_ohs/mod_wl module or the plug-in directory in the web server config and check its version. Affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Then check whether the plug-in has the October 2026 CPU patch applied: run 'opatch lspatches' in the plug-in's Oracle home and compare with the patch listed in the Fusion Middleware Patch Availability Document.","fix":"Apply the Oracle October 2026 Critical Patch Update patch for the WebLogic Server Proxy Plug-in. Get the patch number for your version from the Fusion Middleware Patch Availability Document on My Oracle Support (login needed). Fixed version is unknown from public sources. Until patched, limit network access to the proxying web server to trusted ranges.","status":"open","published_at":"2026-10-20T22:20:07+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:37:10+00:00","updated_at":"2026-10-24T00:01:49+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:37:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown: the sources do not name a patched version. Find the fixed release in Oracle's advisory for this CVE and upgrade the plug-in.","reach":"internet","title":"Oracle WebLogic proxy plug-in flaw lets unauthenticated remote attackers compromise data","impact":"high","summary":"The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. A successful attack can create, change, or delete critical data and read data the plug-in can access, and it can affect other products as well.","category":"runtime","who_cares":["weblogic","oracle-fusion-middleware","web-server-proxy","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads and modifies critical data across connected products","analyst_note":"Find the patched plug-in version and the Oracle advisory for CVE-2026-87300; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87300 does not give a fix.","how_to_check":"Check whether the WebLogic Server Proxy Plug-in for third-party web servers is installed and whether its version is 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0.\nunknown","needs_analyst":true,"not_affected_if":["plug-in-not-installed","other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001047,"input_tokens":3244,"output_tokens":1446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched plug-in version and the Oracle advisory for CVE-2026-87300; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-87300 does not give a fix.","search":"'-2026':15A,18A '-87300':16A,19A '/av':236C '12.2.1.4.0':128C '14.1.1.0.0':129C '14.1.2.0.0':131C '3.1':224C,235C '8.7':227C 'access':85B,141C,186C,199C,205C,211C,221C 'addit':169C 'affect':89B,126C 'allow':136C 'attack':11A,59B,69B,138C,165C,174C 'base':225C 'c/c':241C 'chang':72B,172C 'complet':210C 'compon':109C 'compromis':12A,145C 'confidenti':228C 'creat':71B 'creation':182C 'critic':75B,188C,207C 'cve':14A,17A 'cvss':223C,232C,234C 'data':13A,76B,79B,189C,200C,208C,222C 'delet':74B,183C 'difficult':132C 'exploit':134C 'flaw':7A,55B 'fusion':29B,107C 'h/a':243C 'h/i':242C 'h/pr':238C 'host':34B 'http':63B,143C 'impact':168C,231C 'in':26A 'integr':230C 'let':8A 'log':65B 'may':166C 'middlewar':30B,108C 'modif':185C 'n':244C 'n/ac':237C 'n/s':240C 'n/ui':239C 'network':140C 'oracl':1A,28B,97C,106C,146C,158C,192C,214C 'oracle':20A 'oracle-fusion-middlewar':27B 'parti':50B,119C 'plug':5A,25A,45B,82B,102C,114C,151C,163C,197C,219C 'plug-in':4A,24A,44B,81B,101C,113C,150C,162C,196C,218C 'product':91B,104C,170C 'proxi':3A,38B,43B,100C,112C,149C,161C,195C,217C 'proxy':23A 'reach':61B 'read':78B 'remot':10A,58B 'result':179C 'runtim':31B 'scope':171C 'score':226C 'self':33B 'self-host':32B 'server':22A,37B,42B,52B,99C,111C,121C,148C,160C,194C,216C 'signific':167C 'success':68B,173C 'support':122C 'third':49B,118C 'third-parti':48B,117C 'unauthent':9A,137C 'unauthor':181C,204C 'vector':233C 'version':123C 'via':142C 'vulner':94C,135C,155C,177C 'web':36B,51B,120C 'web-server-proxi':35B 'weblog':2A,39B,41B,98C,110C,147C,159C,193C,215C 'weblogic':21A 'well':93B,202C 'without':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87300","severity":null,"published_at":"2026-10-20T22:20:07+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87300:572","url":null,"severity":null,"published_at":"2026-10-24T00:01:49+00:00","modified_at":"2026-10-24T00:01:49+00:00","first_seen_at":"2026-10-24T00:01:49+00:00","fetched_at":"2026-10-24T00:01:49+00:00","note":"Fixed in Oracle October 2026 CPU (cpuoct2026, 2026-10-20), but the plug-in patch number and fixed version are in the My Oracle Support Patch Availability Document (login needed) and not public; I did not find them. The advisory confirms affected 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CERT-FR lists only 12.2.1.4.0 and 14.1.2.0.0 for the plug-in, a discrepancy. Not exploited and no public PoC found (not in KEV, per Waratek and OpenCVE). Sibling CVE-2026-83379 has an identical description. A Jan 2026 plug-in flaw, CVE-2026-21962, was exploited after a PoC, so patch soon. I did not search social posts."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1639,"url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","title":"Text Form of Oracle CPU October 2026 Risk Matrices","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2312,"url":"https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1355/","title":"CERT-FR CERTFR-2026-AVI-1355: Oracle Weblogic","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}