Live › vulnerability › CVE-2026-91502
Go to dashboardOracle WebLogic Server Core has a flaw that lets an unauthenticated attacker over the network, via TLS, read, change or delete some server-accessible data and partly disrupt the server. The sources list affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 with CVSS 3.1 score 7.3.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the listed WebLogic Server versions that accept network connections over TLS from parties who should not reach them. Internal-only deployments behind strict network controls face less exposure, but the sources do not say how much that reduces risk. Teams on other WebLogic releases are outside the listed versions.
No product ranges from the sources yet.
opatch lspatches in the WebLogic Oracle home and compare against the Oracle Critical Patch Update advisory for the installed release12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
This page as .md · .json · in your agent: get_signal("CVE-2026-91502")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.