CVE-2026-91502: Oracle WebLogic Server Auth Bypass Flaw

CVE-2026-91502 Overview

CVE-2026-91502 is a network-exploitable vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access over Transport Layer Security (TLS) to compromise the server without user interaction. Successful exploitation grants limited unauthorized read access to WebLogic data, limited unauthorized update, insert, or delete access, and partial denial of service against the server. Oracle disclosed the issue in the October 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can modify a subset of WebLogic data, read a subset of accessible data, and partially disrupt service availability through the TLS attack surface.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-10-20 - CVE-2026-91502 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-91502

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is reachable over the network via TLS. Oracle's advisory classifies the flaw as easily exploitable, requiring no authentication and no user interaction. The impact spans all three security properties but is scoped to a subset of accessible data and partial availability loss, rather than full server takeover.

An attacker reaching an exposed WebLogic TLS endpoint can trigger unauthorized state changes against WebLogic-managed data. The same attack path enables limited information disclosure and can degrade service responsiveness, producing a partial denial of service against hosted Java EE applications.

Root Cause

Oracle has not published root-cause details beyond identifying the Core component of WebLogic Server as the affected subsystem. The Core component handles foundational server runtime behavior, including request processing paths accessible through TLS listeners. Full technical specifics are embargoed under Oracle's Critical Patch Update process and are available only in the fixed releases.

Attack Vector

Exploitation requires network reachability to a WebLogic TLS listener. The attacker does not need credentials, administrative access, or interaction from a legitimate user. Internet-exposed WebLogic management or application ports present the highest risk, particularly in Oracle Fusion Middleware deployments that front enterprise applications.

See the Oracle Critical Patch Update - October 2026 for authoritative advisory text. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of the NVD modification date.

Detection Methods for CVE-2026-91502

Indicators of Compromise

Unexpected modifications, inserts, or deletions in WebLogic-managed datasets or configuration stores without a corresponding administrative session
Anomalous TLS connections to WebLogic listener ports from untrusted or geographically unusual source addresses
Spikes in request latency, thread exhaustion, or managed-server restarts consistent with partial denial of service

Detection Strategies

Inventory all WebLogic Server instances at versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and correlate against patch status from the October 2026 Critical Patch Update
Enable WebLogic access and audit logging on TLS listeners, and alert on unauthenticated requests that reach administrative or Core component endpoints
Baseline normal WebLogic request rates and alert on sudden deviations in connection count, error rate, or garbage collection pressure

Monitoring Recommendations

Forward WebLogic server logs, access logs, and JVM metrics to a centralized analytics platform for cross-host correlation
Monitor north-south traffic to WebLogic TLS ports from any network segment that should not reach the server
Track configuration and data-store integrity using file integrity monitoring and database audit trails to detect unauthorized writes

How to Mitigate CVE-2026-91502

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to every affected WebLogic Server instance as the primary remediation
Restrict network access to WebLogic TLS listeners so that only trusted application tiers and administrative networks can reach them
Review authentication, audit, and application logs for signs of unauthorized data modification since the vulnerable versions were deployed

Patch Information

Oracle addresses CVE-2026-91502 in the Oracle Critical Patch Update - October 2026. Administrators should apply the patch bundle corresponding to their WebLogic version: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Oracle recommends applying Critical Patch Updates without delay, as fixes are cumulative and resolve previously disclosed issues.

Workarounds

Place vulnerable WebLogic instances behind a reverse proxy or web application firewall that enforces strict access control on TLS endpoints until patching is complete
Disable or firewall any WebLogic listener that does not need to be reachable from untrusted networks
Enforce network segmentation so that only authorized middleware tiers can initiate TLS connections to WebLogic Core services

bash

# Example: restrict WebLogic TLS listener exposure with host-based firewall rules
# Replace 10.0.0.0/24 with the authorized application tier subnet
iptables -A INPUT -p tcp --dport 7002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -j DROP