CVE-2026-70748 is a critical security vulnerability in Oracle WebLogic Server's core component that allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the server. The vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Exploitation can lead to complete takeover of the server, impacting confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which contains targeted, high-priority security fixes. Oracle strongly recommends applying these patches promptly to mitigate the risk. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to take over the Oracle WebLogic Server, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data breaches, and disruption of services.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches without delay to mitigate the risk of exploitation. Staying on actively supported versions and promptly applying Oracle's security updates is critical. Patch status is confirmed as available through Oracle's official advisory.