{"id":"CVE-2026-91502","kind":"vulnerability","aliases":["CVE-2026-91502"],"related":[],"title":"Oracle WebLogic Server: unauthenticated network flaw allows data changes and partial denial of service","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).","summary":"Oracle WebLogic Server Core has a flaw that lets an unauthenticated attacker over the network, via TLS, read, change or delete some server-accessible data and partly disrupt the server. The sources list affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 with CVSS 3.1 score 7.3.","severity":"high","cvss":7.3,"epss":0.00288,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-fusion-middleware","runtime","self-hosted","weblogic"],"not_affected_if":["default-config"],"how_to_check":"- Run `opatch lspatches` in the WebLogic Oracle home and compare against the Oracle Critical Patch Update advisory for the installed release\n- Check the installed version against the affected list: `12.2.1.4.0`, `14.1.1.0.0`, `14.1.2.0.0`, `15.1.1.0.0`\n- Note whether the WebLogic port is reachable from untrusted networks (unknown from sources)","fix":"- Apply the Oracle Critical Patch Update for WebLogic Server that covers the installed release (patch IDs unknown from sources)\n- Restrict network access to WebLogic admin and TLS listener ports until patched","status":"open","published_at":"2026-10-20T22:20:54+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:27:25+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:27:25Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for WebLogic Server that covers the installed release (patch IDs unknown from sources)\n- Restrict network access to WebLogic admin and TLS listener ports until patched","reach":"internet","title":"Oracle WebLogic Server: unauthenticated network flaw allows data changes and partial denial of service","impact":"medium","summary":"Oracle WebLogic Server Core has a flaw that lets an unauthenticated attacker over the network, via TLS, read, change or delete some server-accessible data and partly disrupt the server. The sources list affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 with CVSS 3.1 score 7.3.","category":"runtime","nicknames":[],"who_cares":["weblogic","oracle-fusion-middleware","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker alters or deletes some server data and disrupts part of the server","analyst_note":"Find the Oracle Critical Patch Update advisory and patch IDs for CVE-2026-91502 and confirm the exact fixed versions and any required configuration.","how_to_check":"- Run `opatch lspatches` in the WebLogic Oracle home and compare against the Oracle Critical Patch Update advisory for the installed release\n- Check the installed version against the affected list: `12.2.1.4.0`, `14.1.1.0.0`, `14.1.2.0.0`, `15.1.1.0.0`\n- Note whether the WebLogic port is reachable from untrusted networks (unknown from sources)","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running the listed WebLogic Server versions that accept network connections over TLS from parties who should not reach them. Internal-only deployments behind strict network controls face less exposure, but the sources do not say how much that reduces risk. Teams on other WebLogic releases are outside the listed versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":3570,"output_tokens":741,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91502':17A,20A '/av':184C '12.2.1.4.0':67B,96C '14.1.1.0.0':68B,97C '14.1.2.0.0':69B,98C '15.1.1.0.0':71B,100C '3.1':74B,171C,183C '7.3':76B,174C 'abil':156C 'access':55B,109C,130C,137C,144C,152C 'affect':65B,94C 'allow':7A,104C 'attack':42B,106C,118C 'avail':178C 'base':172C 'caus':158C 'chang':9A,49B 'compon':88C 'compromis':113C 'confidenti':175C 'core':34B,89C 'cve':15A,18A 'cvss':73B,170C,180C,182C 'data':8A,56B,138C,153C 'delet':51B,129C 'denial':12A,161C 'disrupt':59B 'dos':165C 'easili':101C 'exploit':102C 'flaw':6A,37B 'fusion':24B,86C 'host':29B 'impact':179C 'insert':127C 'integr':176C 'java':21B 'l':192C 'l/a':191C 'l/i':190C 'l/pr':186C 'let':39B 'list':64B 'middlewar':25B,87C 'n/ac':185C 'n/s':188C 'n/ui':187C 'network':5A,45B,108C 'oracl':1A,23B,31B,80C,85C,114C,134C,149C,167C 'oracle-fusion-middlewar':22B 'part':58B 'partial':11A,160C,164C 'product':83C 'read':48B,143C 'result':123C 'runtim':26B 'score':75B,173C 'self':28B 'self-host':27B 'server':3A,33B,54B,61B,82C,116C,136C,151C,169C 'server-access':53B 'servic':14A,163C 'sourc':63B 'subset':147C 'success':117C 'support':90C 'tls':47B,111C 'u/c':189C 'unauthent':4A,41B,105C 'unauthor':125C,142C,155C 'updat':126C 'vector':181C 'version':66B,91C 'via':46B,110C 'vulner':77C,103C,121C 'weblog':2A,30B,32B,81C,115C,135C,150C,168C 'well':140C","nicknames":[],"mitigations":[],"who_affected":"Systems running the listed WebLogic Server versions that accept network connections over TLS from parties who should not reach them. Internal-only deployments behind strict network controls face less exposure, but the sources do not say how much that reduces risk. Teams on other WebLogic releases are outside the listed versions.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91502","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91502","severity":null,"published_at":"2026-10-20T22:20:54+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91502","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91502","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}