CVE-2026-87302: Oracle WebLogic Server Auth Bypass Flaw

CVE-2026-87302 Overview

CVE-2026-87302 is an authentication weakness [CWE-287] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with HTTP network access to compromise the server without user interaction. Successful exploitation grants unauthorized creation, deletion, or modification of all data accessible to WebLogic, along with full read access to that data. Oracle disclosed the issue in the October 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can read and modify all data accessible to Oracle WebLogic Server over HTTP, placing confidentiality and integrity of hosted applications at risk.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-10-20 - CVE-2026-87302 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in the Oracle Critical Patch Update October 2026

Technical Details for CVE-2026-87302

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is categorized as Improper Authentication [CWE-287]. An attacker reaching the HTTP listener can perform privileged operations without supplying valid credentials. Because WebLogic hosts Java EE applications, administrative consoles, and backend integrations, the exposure extends to all data the server can access.

Oracle's advisory notes the flaw is easily exploitable and requires no user interaction. The scope remains unchanged, meaning the attacker affects resources managed by the vulnerable WebLogic instance. Availability is not impacted, but both confidentiality and integrity are fully compromised.

As of publication, the EPSS probability stands at roughly 0.4%, and no public proof-of-concept exploit, CISA KEV listing, or confirmed in-the-wild exploitation has been reported. Historical patterns for WebLogic Core vulnerabilities show that exploitation attempts rise quickly after Oracle Critical Patch Update cycles.

Root Cause

The Core component fails to properly enforce authentication on specific HTTP-accessible operations. Oracle has not published implementation-level details, consistent with its Critical Patch Update disclosure practice. The CWE-287 classification indicates that the authentication check is either missing, incorrectly implemented, or bypassable through crafted request handling.

Attack Vector

Exploitation requires only network reachability to the WebLogic HTTP service. The attacker sends crafted HTTP requests that bypass authentication, enabling read and write access to WebLogic-managed data. Deployments exposing WebLogic ports (commonly 7001 and 7002) to untrusted networks face the highest exposure. Internet-facing management consoles and reverse-proxied application endpoints are prime targets.

No verified exploitation code is publicly available. Refer to the Oracle Critical Patch Update October 2026 advisory for authoritative technical details.

Detection Methods for CVE-2026-87302

Indicators of Compromise

Unexpected HTTP requests to WebLogic administrative paths from external or unapproved internal source addresses.
Creation, deletion, or modification of WebLogic configuration, deployed applications, or JDBC resources outside change-management windows.
Authentication log gaps where privileged actions appear without a preceding successful login event.

Detection Strategies

Inspect WebLogic access logs for anomalous requests to /console, /wls-wsat, and other core servlet paths originating from unauthenticated sessions.
Correlate HTTP request patterns with configuration changes recorded in AdminServer.log and audit logs.
Deploy network intrusion detection signatures targeting malformed HTTP requests aimed at WebLogic listeners once vendor and community signatures are published.

Monitoring Recommendations

Baseline normal administrative activity on WebLogic hosts and alert on deviations in request volume, source, or endpoint.
Forward WebLogic server, access, and audit logs to a centralized analytics platform for retention and correlation.
Monitor outbound connections from WebLogic hosts for signs of post-exploitation data staging or command-and-control traffic.

How to Mitigate CVE-2026-87302

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to all affected WebLogic versions as the primary remediation.
Inventory every WebLogic deployment, including embedded instances in Fusion Middleware stacks, and prioritize internet-exposed servers.
Restrict HTTP access to WebLogic administrative interfaces to trusted management networks using firewall rules or reverse proxy ACLs.
Review audit logs for suspicious administrative actions dating back to before patching.

Patch Information

Oracle addressed CVE-2026-87302 in the Oracle Critical Patch Update October 2026. Patches are available for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle supports only patched, currently maintained releases; older unsupported versions should be upgraded before applying fixes.

Workarounds

Place WebLogic behind an authenticating reverse proxy or web application firewall that enforces strict access control on management endpoints.
Disable or block unused WebLogic components and servlets, including wls-wsat and the T3 protocol where not required.
Segment WebLogic hosts into isolated network zones and require VPN or bastion access for administrative operations until patches are deployed.

bash

# Example: restrict access to the WebLogic admin console at the network edge
# Replace 10.0.0.0/24 with the trusted management subnet
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 7002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -j DROP