CVE-2026-70748 Overview
CVE-2026-70748 is a critical authentication vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware. The flaw resides in the Core subcomponent and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via the T3 or IIOP protocols can exploit the weakness to achieve full compromise of the WebLogic Server. The vulnerability is classified under [CWE-287: Improper Authentication] and impacts confidentiality, integrity, and availability. Oracle addressed the issue in a security alert published in September 2026.
Critical Impact
Unauthenticated remote attackers can take over Oracle WebLogic Server instances exposing T3 or IIOP listeners, leading to full server compromise.
Affected Products
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0
Discovery Timeline
- 2026-09-15 - CVE-2026-70748 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-70748
Vulnerability Analysis
CVE-2026-70748 stems from improper authentication handling in the Core component of Oracle WebLogic Server. The flaw is exposed through the T3 and Internet Inter-ORB Protocol (IIOP) remote invocation channels. These protocols are used for remote method invocation between WebLogic clients and the server. An attacker with network reachability to a listening T3 or IIOP port can bypass authentication and interact with server-side objects. Successful exploitation results in full takeover of the WebLogic Server, including arbitrary code execution in the context of the server process.
The Exploit Prediction Scoring System (EPSS) currently reports a probability of 0.331% for exploitation within 30 days. No public proof-of-concept or in-the-wild exploitation has been confirmed at the time of publication.
Root Cause
The root cause is an authentication weakness [CWE-287] in the WebLogic Core component's handling of T3 and IIOP requests. WebLogic historically exposes trusted remote invocation surfaces that accept serialized objects and remote method calls. When authentication is not enforced correctly, attackers can invoke privileged operations without credentials. This class of flaw has affected WebLogic repeatedly through the T3 protocol stack.
Attack Vector
Exploitation requires only network access to a WebLogic T3 or IIOP listener, typically TCP ports 7001 or 7002. The attack complexity is low, no privileges are required, and no user interaction is needed. Attackers craft malicious T3 or IIOP protocol messages targeting the vulnerable Core handling logic. Because WebLogic servers are frequently deployed as internet-facing middleware for enterprise applications, exposed instances are directly reachable from the internet.
No verified public exploit code exists at this time. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.
Detection Methods for CVE-2026-70748
Indicators of Compromise
- Unexpected inbound connections to WebLogic T3/T3s (7001, 7002) or IIOP ports from untrusted networks.
- New or unexpected child processes spawned by the WebLogic Java process, such as shells, cmd.exe, powershell.exe, or curl/wget.
- Modified or newly created files under WebLogic domain directories including servers/<name>/tmp and deployment staging paths.
- Outbound network connections from WebLogic hosts to unknown external IP addresses shortly after inbound T3/IIOP traffic.
Detection Strategies
- Inspect WebLogic access and server logs for anomalous T3 or IIOP requests, particularly those containing serialized Java objects or unusual class references.
- Correlate authentication failures and successful invocations across AdminServer.log and access.log to spot unauthenticated remote method calls.
- Deploy network-based signatures that identify malformed T3 handshakes or IIOP GIOP messages targeting WebLogic listeners.
Monitoring Recommendations
- Enable and forward WebLogic domain and server logs to a centralized SIEM for continuous inspection.
- Monitor process ancestry on WebLogic hosts to flag unexpected child processes of the Java runtime.
- Alert on outbound egress from middleware tiers to non-approved destinations, which often indicates post-exploitation command and control.
How to Mitigate CVE-2026-70748
Immediate Actions Required
- Apply the Oracle security patch referenced in Oracle Security Alert CSPUSEP2026 to all affected WebLogic versions.
- Inventory all WebLogic Server instances and identify those exposing T3, T3s, or IIOP to untrusted networks.
- Block external access to WebLogic administrative ports at the perimeter firewall and internal segmentation boundaries.
- Review WebLogic logs for signs of prior exploitation targeting T3 or IIOP endpoints.
Patch Information
Oracle released a fix as part of the September 2026 security alert cycle. Administrators should upgrade or apply the patches referenced in Oracle Security Alert CSPUSEP2026 for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Patching is the only complete remediation.
Workarounds
- Restrict T3 and IIOP protocol access using the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to allow only trusted management hosts.
- Disable IIOP in the Administration Console under Protocols if the protocol is not required by applications.
- Place WebLogic instances behind a reverse proxy or web application firewall that terminates only HTTP/HTTPS traffic and blocks direct T3/IIOP connectivity.
# Example WebLogic connection filter rules restricting T3/IIOP to trusted subnets
# Configure in the Administration Console: Domain -> Security -> Filter
# Filter class: weblogic.security.net.ConnectionFilterImpl
10.0.0.0/8 * * allow t3 t3s iiop iiops
192.168.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny t3 t3s iiop iiops
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
