CVE-2026-70756: Oracle WebLogic Server Auth Bypass Flaw

CVE-2026-70756 Overview

CVE-2026-70756 is an authentication weakness [CWE-287] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Affected releases include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated remote attacker can exploit the flaw over the T3 or IIOP protocols to fully compromise the server. Successful exploitation results in complete takeover of the WebLogic instance, including full loss of confidentiality, integrity, and availability. Oracle disclosed the issue in its September 2026 Critical Security Alert.

Critical Impact
Unauthenticated network attackers reachable over T3 or IIOP can take over vulnerable Oracle WebLogic Server instances without user interaction.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-09-15 - CVE-2026-70756 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-70756

Vulnerability Analysis

The flaw resides in the Core component of Oracle WebLogic Server and is reachable through the T3 and Internet Inter-ORB Protocol (IIOP) remote invocation channels. These protocols expose Java Remote Method Invocation (RMI) endpoints used for administrative and clustering functions. Because authentication is not properly enforced on these entry points, an attacker with only network reachability can invoke server-side operations. Oracle rates the issue with a CVSS 3.1 base score reflecting full impact to confidentiality, integrity, and availability.

Root Cause

The issue is categorized under Improper Authentication [CWE-287]. The T3 and IIOP listeners accept requests that should require authenticated principals but fail to validate credentials before processing sensitive operations. This gap allows attacker-supplied requests to reach privileged code paths in the WebLogic Core component.

Attack Vector

Exploitation requires network access to the WebLogic T3 or IIOP listener ports. No user interaction, credentials, or prior foothold are needed. Attack complexity is low, and the attack scope is unchanged. Successful exploitation results in full server takeover, allowing arbitrary command execution in the context of the WebLogic process. Refer to the Oracle Security Alert for vendor technical details. Verified proof-of-concept code is not currently published.

Detection Methods for CVE-2026-70756

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001) or IIOP endpoints from untrusted source IPs.
Anomalous child processes spawned by the WebLogic Java process, particularly shells, cmd.exe, or scripting interpreters.
New or modified files under WebLogic domain directories, especially deployed WAR/EAR artifacts written outside change windows.
Outbound network connections from the WebLogic host to unfamiliar external infrastructure.

Detection Strategies

Inspect WebLogic access.log and server logs for unauthenticated T3/IIOP requests targeting administrative interfaces.
Alert on Java process spawning native OS commands, a common post-exploitation pattern for WebLogic deserialization and authentication-bypass chains.
Correlate network telemetry on ports 7001, 7002, and configured IIOP ports with process-level events on the host.

Monitoring Recommendations

Enable verbose T3 and IIOP protocol logging on WebLogic servers exposed to less-trusted networks.
Forward WebLogic and host telemetry to a centralized analytics platform for correlation across sessions and hosts.
Baseline normal administrative source IPs and alert on deviations targeting management protocols.

How to Mitigate CVE-2026-70756

Immediate Actions Required

Apply the September 2026 Oracle Critical Security Alert fixes to all affected WebLogic versions.
Restrict network access to T3 and IIOP listener ports so only trusted management hosts can reach them.
Audit exposed WebLogic instances for signs of prior exploitation before, during, and after patching.

Patch Information

Oracle addressed CVE-2026-70756 in the September 2026 Critical Security Alert. Administrators should install the corresponding patches for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 as documented in the Oracle Security Alert.

Workarounds

Use the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP from untrusted networks until patches are applied.
Disable IIOP in the WebLogic Administration Console if the protocol is not required by hosted applications.
Place WebLogic administrative interfaces behind a network segment reachable only via VPN or jump hosts.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Set in Admin Console: Domain > Security > Filter > Connection Filter Rules
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0  * * deny  t3 t3s iiop iiops