CVE-2026-91502 is a high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via TLS to perform unauthorized read, update, insert, or delete operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 7.3, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across multiple products. However, no explicit patch links or fixed versions for this specific vulnerability are provided in the available data.
CVE-2026-91323 is a critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the server, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate this risk.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101515 is a vulnerability in Oracle WebLogic Server's Centralized Thirdparty Jars component affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via HTTP to potentially gain unauthorized access to critical or all accessible data on the server. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9, primarily impacting confidentiality. Oracle has released security patches as part of their October 2026 Critical Patch Update and strongly recommends applying these patches promptly.
CVE-2026-83038 is a critical vulnerability in Oracle WebLogic Server's TopLink Integration component. It allows a low privileged attacker with network access via HTTP to compromise the server, potentially leading to full takeover. The vulnerability affects specific versions of Oracle WebLogic Server and can impact additional products due to scope change. The CVSS 3.1 base score is 9.9, indicating severe confidentiality, integrity, and availability impacts. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-60977 is a critical vulnerability in Oracle WebLogic Server allowing an unauthenticated attacker with network access via RMI to fully compromise the server. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Successful exploitation can lead to complete takeover of the affected server, impacting confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities. Customers are strongly advised to apply the patches promptly to mitigate risk.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-60699 is a high-severity vulnerability in Oracle WebLogic Server that allows an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the server. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle WebLogic Server. The vulnerability affects specific versions of Oracle WebLogic Server and may impact additional Oracle products. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities, strongly recommending patch application.
CVE-2026-60698 is a critical vulnerability in Oracle WebLogic Server that allows an unauthenticated attacker with network access via IIOP to compromise the server. Successful exploitation can lead to full takeover of the Oracle WebLogic Server, impacting confidentiality, integrity, and availability. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities, and strongly recommends applying patches promptly.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-60680 is a high-severity vulnerability in Oracle WebLogic Server that allows a low privileged attacker with network access via HTTP to compromise the server. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data on the server, as well as cause a hang or repeated crash resulting in denial of service. The affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
CVE-2026-60679 is a high-severity vulnerability in Oracle WebLogic Server that allows a low privileged attacker with network access via T3 and IIOP protocols to potentially take over the server. The vulnerability affects specific versions of Oracle WebLogic Server and has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate risk.
CVE-2026-60672 is a critical vulnerability in Oracle WebLogic Server allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the server. Successful exploitation can lead to full takeover of the Oracle WebLogic Server. The vulnerability affects specific versions of Oracle WebLogic Server and has a CVSS 3.1 base score of 9.8, indicating severe confidentiality, integrity, and availability impacts. Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update.
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).