Actively exploited in the wild
Oracle WebLogic Server Unspecified Vulnerability
Oracle - WebLogic Server · Listed in the CISA KEV since 2023-05-01. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2023-21839
HighCVSS 7.5KEVSummary
Vulnerability in Oracle WebLogic Server (component: Core) affecting versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server, resulting in unauthorized access to critical data. CVSS 3.1 Base Score 7.5.
Risk Assessment
An attacker could gain access to sensitive data stored on the WebLogic server, potentially leading to information disclosure and security breaches.
Recommendation
Update Oracle WebLogic Server to the latest version with security patches and restrict network access to T3/IIOP ports.
Other vulnerabilities in Oracle WebLogic Server
See all- CVE-2026-101515Medium
Vulnerability in Oracle WebLogic Server (component: Centralized Thirdparty Jars) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all server data.
- CVE-2017-10147High
A vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 to compromise the server. Attacks may lead to hanging or frequent crashes of the server, resulting in a complete denial of service (DoS).
- CVE-2016-3505High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
- CVE-2016-0577High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0574High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0573High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
- CVE-2016-0572High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
- CVE-2014-2470High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
- CVE-2026-91323Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with HTTP network access can take over the server.
- CVE-2026-87302Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data and gain full access to it.
Original NVD description (English source)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS