{"id":"CVE-2026-91323","kind":"vulnerability","aliases":["CVE-2026-91323"],"related":[],"title":"Oracle WebLogic Server: unauthenticated HTTP flaw allows full server takeover","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Unauthenticated HTTP flaw in Oracle WebLogic Server Core (CVSS 9.8) lets a remote attacker take over the server. It is fixed in Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC yet, but WebLogic is historically a favourite target when internet-exposed.","severity":"critical","cvss":9.8,"epss":0.00483,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle WebLogic Server","fixed":["PSU 40069416 (12.2.1.4.0)","PSU 40069954 (14.1.1.0.0)","PSU 40058371 (14.1.2.0.0)","PSU 40050052 (15.1.1.0.0)"],"affected":"12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","oracle","runtime","self-hosted","weblogic"],"not_affected_if":["managed-hosting"],"how_to_check":"Find the WebLogic version and installed patches. Run $ORACLE_HOME/OPatch/opatch lspatches and look for the PSU for your release (40050052 for 15.1.1.0.0, 40058371 for 14.1.2.0.0, 40069954 for 14.1.1.0.0, 40069416 for 12.2.1.4.0). If it is missing and the version is 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0, you are exposed. Prioritise instances whose HTTP listener (default 7001/7002) is reachable from the internet.","fix":"Apply the October 2026 WebLogic PSU for your release: 15.1.1.0.0 -> 40050052; 14.1.2.0.0 -> 40058371; 14.1.1.0.0 -> 40069954; 12.2.1.4.0 -> 40069416 (patch numbers per Rapid7; confirm against Oracle's patch availability document). Until patched, restrict network access to WebLogic HTTP ports to trusted networks.","status":"open","published_at":"2026-10-20T22:20:34+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-23T22:34:04+00:00","updated_at":"2026-10-25T12:38:52+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T22:34:04Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update for the affected WebLogic release; the advisory text does not name the patch.","reach":"internet","title":"Oracle WebLogic Server: unauthenticated HTTP flaw allows full server takeover","impact":"high","summary":"Oracle WebLogic Server Core, in the listed 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 releases, has a flaw that an unauthenticated attacker can reach over the network via HTTP. A successful attack lets the attacker take over the server, with full confidentiality, integrity and availability impact.","category":"runtime","who_cares":["weblogic","java","oracle","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker takes over the server and reads or changes all its data","analyst_note":"Find the Oracle CPU advisory for CVE-2026-91323 to get the patch name, the exact affected component and a detection method; the NVD entry has no fix or check details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000531,"input_tokens":3100,"output_tokens":442,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory for CVE-2026-91323 to get the patch name, the exact affected component and a detection method; the NVD entry has no fix or check details.","search":"'-2026':12A,15A '-91323':13A,16A '/av':141C '12.2.1.4.0':93C '14.1.1.0.0':94C '14.1.2.0.0':95C '15.1.1.0.0':97C '2026':52B '3.1':128C,140C '9.8':36B,131C 'access':106C 'affect':91C 'allow':7A,101C 'attack':40B,103C,115C 'avail':135C 'base':129C 'compon':85C 'compromis':110C 'confidenti':132C 'core':34B,86C 'critic':53B 'cve':11A,14A 'cvss':35B,127C,137C,139C 'easili':98C 'exploit':58B,99C 'expos':73B 'favourit':68B 'fix':47B 'flaw':6A,29B 'full':8A 'fusion':83C 'h':149C 'h/a':148C 'h/i':147C 'histor':66B 'host':25B 'http':5A,28B,108C 'impact':136C 'integr':133C 'internet':72B 'internet-expos':71B 'java':20B 'known':57B 'l/pr':143C 'let':37B 'middlewar':84C 'n/ac':142C 'n/s':145C 'n/ui':144C 'network':105C 'octob':51B 'oracl':1A,21B,31B,49B,77C,82C,111C,124C 'oracle':17A 'patch':54B 'poc':61B 'product':80C 'public':60B 'remot':39B 'result':120C 'runtim':22B 'score':130C 'self':24B 'self-host':23B 'server':3A,9A,19A,33B,44B,79C,113C,126C 'success':114C 'support':87C 'take':41B 'takeov':10A,122C 'target':69B 'u/c':146C 'unauthent':4A,27B,102C 'updat':55B 'vector':138C 'version':88C 'via':107C 'vulner':74C,100C,118C 'weblog':2A,26B,32B,64B,78C,112C,125C 'weblogic':18A 'yet':62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91323","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91323","severity":null,"published_at":"2026-10-20T22:20:34+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91323:336","url":null,"severity":null,"published_at":"2026-10-23T22:57:18+00:00","modified_at":"2026-10-23T22:57:18+00:00","first_seen_at":"2026-10-23T22:57:18+00:00","fetched_at":"2026-10-23T22:57:18+00:00","note":"Oracle CPU Oct 2026 lists WebLogic Server (Core) fix; PSU numbers come from Rapid7, not read on Oracle's patch-availability doc (not fetched). No exploitation or public PoC found; X posts are just advisory reposts. Sibling CVE-2026-83399 (T3/IIOP) is a separate WebLogic flaw."},{"source":"epss","external_id":"CVE-2026-91323","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91323","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:52+00:00","fetched_at":"2026-10-25T12:38:52+00:00","note":null}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1692,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-91323/","title":"Rapid7 DB: Oracle WebLogic CVE-2026-91323 (PSU numbers)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1693,"url":"https://orbitaley.com/news/oracle-fixes-two-critical-weblogic-server-flaws-in-its-october-quarterly-patch-d1kmc","title":"Orbitaley: Oracle fixes two critical WebLogic Server flaws","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}