---
id: "CVE-2026-91502"
kind: "vulnerability"
aliases: ["CVE-2026-91502"]
title: "Oracle WebLogic Server: unauthenticated network flaw allows data changes and partial denial of service"
severity: "high"
cvss: 7.3
epss: 0.00288
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "runtime", "self-hosted", "weblogic"]
not_affected_if: ["default-config"]
published_at: "2026-10-20T22:20:54+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91502", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91502", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle WebLogic Server: unauthenticated network flaw allows data changes and partial denial of service

Oracle WebLogic Server Core has a flaw that lets an unauthenticated attacker over the network, via TLS, read, change or delete some server-accessible data and partly disrupt the server. The sources list affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 with CVSS 3.1 score 7.3.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `opatch lspatches` in the WebLogic Oracle home and compare against the Oracle Critical Patch Update advisory for the installed release
- Check the installed version against the affected list: `12.2.1.4.0`, `14.1.1.0.0`, `14.1.2.0.0`, `15.1.1.0.0`
- Note whether the WebLogic port is reachable from untrusted networks (unknown from sources)

## Fix

- Apply the Oracle Critical Patch Update for WebLogic Server that covers the installed release (patch IDs unknown from sources)
- Restrict network access to WebLogic admin and TLS listener ports until patched

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91502
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91502

## From the sources

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_