How does CVE-2026-87302 expose Oracle WebLogic to unauthenticated data theft?
A critical flaw in recent WebLogic releases allows remote attackers to manipulate or steal data without credentials.
Key points
- CVE-2026-87302 affects WebLogic versions 12.2.1.4.0 through 15.1.1.0.0.
- The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.1.
- Unauthenticated network access via HTTP is sufficient for exploitation.
The short version
- Oracle WebLogic Server faces a high-severity vulnerability allowing unauthenticated data manipulation.
- Affected components include the Core module of Oracle Fusion Middleware.
- Attackers can create, delete, or modify critical data without prior access.
The details
The National Vulnerability Database records CVE-2026-87302 as a critical vulnerability within Oracle WebLogic Server. This flaw resides in the Core component of Oracle Fusion Middleware. It impacts supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The issue is easily exploitable over standard HTTP connections. Attackers do not need authentication to trigger the vulnerability. They only require network access to the affected server instance. Successful exploitation leads to significant data compromise.
The context
The CVSS 3.1 base score for this issue is 9.1. This rating reflects high impacts on both confidentiality and integrity. The vector string indicates network accessibility with low complexity. No user interaction is required for the attack to succeed. The scope of the vulnerability remains unchanged, meaning the impact is confined to the vulnerable component. However, the ability to modify or delete critical data represents a severe operational risk. Organizations running these specific WebLogic versions are directly exposed.
Next steps
Security teams should immediately inventory their environments for the affected WebLogic versions. Identify any instances of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0. Check network logs for unauthorised HTTP traffic targeting these servers. Consider isolating vulnerable instances to reduce exposure. Restrict network access to WebLogic consoles where possible. Monitor for anomalous data modification or deletion events.
What defenders should look for
Teams usually detect this activity by analysing web server access logs for unusual HTTP requests. Look for spikes in traffic from unknown sources targeting WebLogic endpoints. Alert on any unauthorised data creation, deletion or modification events within the application layer. Check whether database integrity checks reveal unexpected changes to critical records. First containment moves involve restricting network access to the affected servers. Verify that all administrative interfaces are secured behind strict firewall rules. Monitor for lateral movement attempts following initial compromise.
What to do and how to stay safe: Oracle WebLogic Server
- Audit all WebLogic Server installations to identify affected versions.
- Restrict inbound HTTP traffic to WebLogic ports using network firewalls.
- Enable detailed logging on all WebLogic instances to capture exploit attempts.
- Prepare an incident response plan for potential data manipulation events.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which WebLogic versions are affected by CVE-2026-87302?
Versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected.
What is the CVSS score for this vulnerability?
The CVSS 3.1 base score is 9.1, rated as critical.
Does the attacker need authentication to exploit this flaw?
No, the vulnerability allows unauthenticated access via HTTP.
