--- id: "CVE-2026-91323" kind: "vulnerability" aliases: ["CVE-2026-91323"] title: "Oracle WebLogic Server: unauthenticated HTTP flaw allows full server takeover" severity: "critical" cvss: 9.8 epss: 0.00483 exploited: false status: "open" category: "runtime" products: [{"name": "Oracle WebLogic Server", "fixed": ["PSU 40069416 (12.2.1.4.0)", "PSU 40069954 (14.1.1.0.0)", "PSU 40058371 (14.1.2.0.0)", "PSU 40050052 (15.1.1.0.0)"], "affected": "12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["java", "oracle", "runtime", "self-hosted", "weblogic"] not_affected_if: ["managed-hosting"] published_at: "2026-10-20T22:20:34+00:00" first_seen_at: "2026-10-23T21:57:26+00:00" updated_at: "2026-10-25T12:38:52+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91323", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:57:18+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91323", "first_seen_at": "2026-10-25T12:38:52+00:00"}] --- # Oracle WebLogic Server: unauthenticated HTTP flaw allows full server takeover Unauthenticated HTTP flaw in Oracle WebLogic Server Core (CVSS 9.8) lets a remote attacker take over the server. It is fixed in Oracle's October 2026 Critical Patch Update. No known exploitation or public PoC yet, but WebLogic is historically a favourite target when internet-exposed. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Oracle WebLogic Server affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0 fixed PSU 40069416 (12.2.1.4.0), PSU 40069954 (14.1.1.0.0), PSU 40058371 (14.1.2.0.0), PSU 40050052 (15.1.1.0.0) ## How to check Find the WebLogic version and installed patches. Run $ORACLE_HOME/OPatch/opatch lspatches and look for the PSU for your release (40050052 for 15.1.1.0.0, 40058371 for 14.1.2.0.0, 40069954 for 14.1.1.0.0, 40069416 for 12.2.1.4.0). If it is missing and the version is 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0, you are exposed. Prioritise instances whose HTTP listener (default 7001/7002) is reachable from the internet. ## Fix Apply the October 2026 WebLogic PSU for your release: 15.1.1.0.0 -> 40050052; 14.1.2.0.0 -> 40058371; 14.1.1.0.0 -> 40069954; 12.2.1.4.0 -> 40069416 (patch numbers per Rapid7; confirm against Oracle's patch availability document). Until patched, restrict network access to WebLogic HTTP ports to trusted networks. ## Timeline - 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91323 - 2026-10-23T22:57:18+00:00 analyst — Oracle CPU Oct 2026 lists WebLogic Server (Core) fix; PSU numbers come from Rapid7, not read on Oracle's patch-availability doc (not fetched). No exploitation or public PoC found; X posts are just advisory reposts. Sibling CVE-2026-83399 (T3/IIOP) is a separate WebLogic flaw. - 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91323 ## Documents - [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html - [describes] Orbitaley: Oracle fixes two critical WebLogic Server flaws https://orbitaley.com/news/oracle-fixes-two-critical-weblogic-server-flaws-in-its-october-quarterly-patch-d1kmc - [fix] Rapid7 DB: Oracle WebLogic CVE-2026-91323 (PSU numbers) https://www.rapid7.com/db/vulnerabilities/cve-2026-91323/ ## From the sources Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_