CVE-2025-61752
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Oracle WebLogic Server (component: Core). Affected versions are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts).
Risk Assessment
An unauthenticated attacker can cause complete denial of service of Oracle WebLogic Server, potentially disrupting applications based on this server.
Recommendation
Apply patches provided by Oracle for versions 14.1.1.0.0 and 14.1.2.0.0. Restrict network access to the server.
Other vulnerabilities in Oracle WebLogic Server
See all- CVE-2017-10147High
A vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 to compromise the server. Attacks may lead to hanging or frequent crashes of the server, resulting in a complete denial of service (DoS).
- CVE-2016-3505High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
- CVE-2016-0577High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0574High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0573High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
- CVE-2016-0572High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
- CVE-2014-2470High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
- CVE-2026-83038Critical
Vulnerability in Oracle WebLogic Server (TopLink Integration component) of Oracle Fusion Middleware. Affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low privileged attacker with network access via HTTP can easily compromise Oracle WebLogic Server.
- CVE-2026-83021Critical
Vulnerability in Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Affects versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable, allows unauthenticated attacker via HTTP to take over the server, with impact on other products (scope change). CVSS 10.0.
- CVE-2026-70757Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
Original NVD description (English source)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS