CVE-2026-70757: Oracle WebLogic Server Auth Bypass

CVE-2026-70757 Overview

CVE-2026-70757 is a critical authentication weakness [CWE-287] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated remote attacker can exploit the flaw over the T3 or IIOP protocols to take over the server. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle disclosed the issue in a Critical Patch Update Security Alert. The vulnerability requires no user interaction and no privileges, and it impacts confidentiality, integrity, and availability.

Critical Impact
Unauthenticated network attackers reaching T3 or IIOP listeners can fully compromise Oracle WebLogic Server, enabling arbitrary application control and data theft.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-09-15 - CVE-2026-70757 published to NVD
2026-09-16 - Last updated in NVD database
2026-09 - Oracle issued a Security Alert referencing this CVE (Oracle Security Alert)

Technical Details for CVE-2026-70757

Vulnerability Analysis

The flaw resides in the WebLogic Server Core component, which handles remote invocation via the T3 and Internet Inter-ORB Protocol (IIOP) listeners. These protocols expose Java remote method dispatch to network clients and have a long history of authentication and deserialization abuse. Oracle characterizes the issue as easily exploitable by an unauthenticated attacker with network reach to the WebLogic listener. Successful exploitation results in complete takeover of the WebLogic Server, meaning the attacker can execute application logic, extract data, and disrupt service.

Because WebLogic frequently hosts enterprise middleware, identity connectors, and back-office integrations, a compromised instance often provides pivot paths into databases, message brokers, and internal services. The Exploit Prediction Scoring System currently places this CVE in a modest exploitation likelihood band, but Oracle WebLogic historically sees rapid weaponization once technical details surface.

Root Cause

The CWE-287 classification indicates improper authentication in the code path that services T3 and IIOP requests. An attacker can complete a privileged operation without presenting valid credentials to the WebLogic Core. Oracle has not published implementation-level details beyond the advisory.

Attack Vector

Exploitation requires network access to the WebLogic T3 or IIOP listener, which defaults to the administration and managed server ports. The attack requires no authentication, no user interaction, and low complexity. Any host that can reach these ports, including through misconfigured load balancers or exposed cloud instances, can attempt exploitation. No public proof-of-concept code is available at the time of writing. Refer to the Oracle Security Alert for vendor technical guidance.

Detection Methods for CVE-2026-70757

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (default 7001) or IIOP ports from untrusted networks.
New or modified .war, .jar, or JSP files under WebLogic domain and application deployment directories.
Child processes such as cmd.exe, powershell.exe, /bin/sh, or curl spawned by the WebLogic Java process.
Outbound connections from the WebLogic host to unfamiliar IPs shortly after inbound T3 or IIOP traffic.

Detection Strategies

Inspect WebLogic access and server logs for anomalous T3 or IIOP handshake patterns and repeated deserialization errors.
Correlate network flow data with process telemetry to identify remote invocation followed by shell or scripting activity.
Deploy authenticated vulnerability scans that fingerprint WebLogic build numbers against the fixed release baseline.

Monitoring Recommendations

Alert on any T3 or IIOP traffic originating outside defined administrative subnets.
Monitor for file writes to WebLogic servers/<name>/tmp and autodeploy directories outside change windows.
Track JVM argument changes and JNDI lookups initiated by the WebLogic process.

How to Mitigate CVE-2026-70757

Immediate Actions Required

Apply the Oracle Security Alert patch for CVE-2026-70757 on all WebLogic instances at versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict T3 and IIOP listener access to trusted management subnets using network segmentation and host firewalls.
Audit exposure of WebLogic ports at internet-facing load balancers, reverse proxies, and cloud security groups.

Patch Information

Oracle addressed CVE-2026-70757 in the Critical Patch Update Security Alert referenced at Oracle Security Alert. Administrators should review the alert matrix to identify the exact patch bundle for each affected release and apply it through Oracle OPatch on all managed and administration servers.

Workarounds

Configure the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP from untrusted sources until patches are applied.
Disable the IIOP protocol on managed servers that do not require CORBA interoperability.
Place WebLogic administration listeners behind a VPN or bastion host and block direct internet exposure.

bash

# Example WebLogic connection filter rules to block T3/T3S/IIOP from untrusted networks
# Set in the Administration Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules:
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny  t3 t3s iiop iiops