--- id: "CVE-2026-87300" kind: "vulnerability" aliases: ["CVE-2026-87300"] title: "Oracle WebLogic proxy plug-in flaw lets unauthenticated remote attackers compromise data" severity: "high" cvss: 8.7 epss: null exploited: false status: "open" category: "runtime" products: [{"name": "Oracle WebLogic Server Proxy Plug-in", "fixed": [], "affected": "12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0", "ecosystem": "vendor"}] ecosystems: [] tags: ["oracle-fusion-middleware", "runtime", "self-hosted", "web-server-proxy", "weblogic"] not_affected_if: ["other-versions", "plug-in-not-installed"] published_at: "2026-10-20T22:20:07+00:00" first_seen_at: "2026-10-23T21:57:25+00:00" updated_at: "2026-10-24T00:01:49+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87300", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:01:49+00:00"}] --- # Oracle WebLogic proxy plug-in flaw lets unauthenticated remote attackers compromise data The WebLogic Server Proxy Plug-in for third-party web servers has a flaw that a remote attacker can reach over HTTP without logging in. A successful attack can create, change, or delete critical data and read data the plug-in can access, and it can affect other products as well. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Oracle WebLogic Server Proxy Plug-in affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 fixed ? ## How to check Find out whether the WebLogic Server Proxy Plug-in for third-party web servers (Apache HTTP Server, IIS, etc.) is installed in front of WebLogic and which version it is. Look for the mod_wl_ohs/mod_wl module or the plug-in directory in the web server config and check its version. Affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Then check whether the plug-in has the October 2026 CPU patch applied: run 'opatch lspatches' in the plug-in's Oracle home and compare with the patch listed in the Fusion Middleware Patch Availability Document. ## Fix Apply the Oracle October 2026 Critical Patch Update patch for the WebLogic Server Proxy Plug-in. Get the patch number for your version from the Fusion Middleware Patch Availability Document on My Oracle Support (login needed). Fixed version is unknown from public sources. Until patched, limit network access to the proxying web server to trusted ranges. ## Timeline - 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87300 - 2026-10-24T00:01:49+00:00 analyst — Fixed in Oracle October 2026 CPU (cpuoct2026, 2026-10-20), but the plug-in patch number and fixed version are in the My Oracle Support Patch Availability Document (login needed) and not public; I did not find them. The advisory confirms affected 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CERT-FR lists only 12.2.1.4.0 and 14.1.2.0.0 for the plug-in, a discrepancy. Not exploited and no public PoC found (not in KEV, per Waratek and OpenCVE). Sibling CVE-2026-83379 has an identical description. A Jan 2026 plug-in flaw, CVE-2026-21962, was exploited after a PoC, so patch soon. I did not search social posts. ## Documents - [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html - [advisory] Text Form of Oracle CPU October 2026 Risk Matrices https://www.oracle.com/security-alerts/cpuoct2026verbose.html - [mentions] CERT-FR CERTFR-2026-AVI-1355: Oracle Weblogic https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1355/ ## From the sources Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_