CVE-2026-91323: Oracle WebLogic Server Auth Bypass Flaw

CVE-2026-91323 Overview

CVE-2026-91323 is an authentication weakness [CWE-287] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the server without user interaction. Successful exploitation results in full takeover of the Oracle WebLogic Server instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the October 2026 Critical Patch Update and lists affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Remote, unauthenticated attackers can take over Oracle WebLogic Server instances exposed over HTTP, gaining control of hosted applications and connected data stores.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-10-20 - CVE-2026-91323 published to the National Vulnerability Database
2026-10-21 - Entry last updated in NVD
October 2026 - Addressed in the Oracle Security Alert October 2026

Technical Details for CVE-2026-91323

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. An attacker reaches the vulnerable code path by sending crafted HTTP requests to an exposed WebLogic listener. No credentials, no user interaction, and no prior foothold are required.

Oracle categorizes the outcome as full takeover of the server. That outcome maps to arbitrary code execution or administrative control within the WebLogic process. Hosted Java EE applications, JDBC data sources, and connected backend systems become reachable through the compromised instance.

The weakness is classified under [CWE-287] Improper Authentication. The EPSS model places the probability of near-term exploitation at 0.483% as of 2026-10-22, below the threshold typical of widely weaponized Oracle flaws but still relevant for internet-exposed deployments.

Root Cause

Oracle's advisory does not publish source-level detail. The [CWE-287] classification indicates that the Core component accepts requests without correctly verifying the identity of the caller. Historical WebLogic Core issues have involved T3, IIOP, and HTTP handlers that trust client-supplied data when selecting authentication paths. Administrators should treat CVE-2026-91323 as an unauthenticated path to privileged WebLogic functionality until Oracle releases further technical analysis.

Attack Vector

Exploitation occurs over the network via HTTP. The attacker needs line-of-sight to a WebLogic listener, typically ports 7001 or 7002. Any WebLogic Server reachable from the public internet, a partner network, or a compromised internal host is in scope. The vulnerability can be chained with lateral movement once initial takeover is achieved, because WebLogic frequently stores credentials for databases, LDAP directories, and messaging systems.

No public proof-of-concept, Metasploit module, or exploit database entry was listed at the time of publication. See the Oracle Security Alert October 2026 for vendor guidance.

Detection Methods for CVE-2026-91323

Indicators of Compromise

Unexpected child processes spawned by the WebLogic java process, especially cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
New or modified .jsp, .war, or .class files under WebLogic deployment and tmp directories outside normal change windows.
Outbound connections from WebLogic hosts to unfamiliar IP addresses on ports commonly used for reverse shells or payload staging.
HTTP requests to WebLogic management paths such as /console, /wls-wsat, or /_async/ from untrusted source addresses.

Detection Strategies

Alert on process-lineage anomalies where java or startWebLogic processes spawn interactive shells or scripting interpreters.
Inspect WebLogic access.log and AdminServer.log for HTTP requests with oversized or malformed headers targeting Core servlet paths.
Correlate authentication events in WebLogic with upstream reverse proxy logs to identify requests that bypass expected login flows.

Monitoring Recommendations

Forward WebLogic server logs, host process telemetry, and network flow data into a centralized analytics platform for cross-source correlation.
Baseline normal administrative traffic to WebLogic listeners and alert on deviations in geography, user agent, and request volume.
Monitor file integrity on WebLogic domain, applications, and servers/*/tmp directories for unauthorized writes.

How to Mitigate CVE-2026-91323

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update for every WebLogic Server instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Inventory all WebLogic instances, including those embedded within Fusion Middleware stacks such as SOA Suite, Forms, and Identity Management.
Block inbound access to WebLogic listeners from untrusted networks at the perimeter firewall and reverse proxy.
Rotate credentials, keystores, and database passwords stored in WebLogic domains if compromise cannot be ruled out.

Patch Information

Oracle published fixes in the October 2026 Critical Patch Update. Review the Oracle Security Alert October 2026 for patch identifiers, prerequisite bundle patches, and version-specific installation instructions. Oracle's standard policy limits security fixes to supported versions, so instances running unsupported WebLogic releases should be upgraded before patching.

Workarounds

Restrict HTTP access to WebLogic administrative and Core endpoints using network ACLs, reverse proxy rules, or a web application firewall.
Disable or filter unused protocols on the WebLogic listener, including T3 and IIOP, where business requirements allow.
Place internet-facing WebLogic deployments behind an authenticating gateway until the patch is applied.

bash

# Example: restrict WebLogic listener access to trusted management hosts
# Replace 10.0.0.0/24 with your approved administrative CIDR
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 7002 -j DROP