CVE-2026-70748: 
Oracle WebLogic Server vulnerability analysis and mitigation

CVE-2026-70748 is a critical improper authentication vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated remote attacker with network access via the T3 or IIOP protocols can exploit this vulnerability to achieve complete takeover of the affected server. It was disclosed and patched on September 15, 2026, as part of Oracle's Critical Security Patch Update (CSPU). The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Oracle Advisory).

The vulnerability is classified under CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function), indicating that the WebLogic Server Core component fails to properly enforce authentication for critical operations accessible via the T3 and IIOP protocols. T3 and IIOP are Oracle-proprietary and standard remote object protocols used for Java EE communication with WebLogic, and they are commonly exposed on default ports (7001/7002). An unauthenticated attacker with network-level access to these ports can send specially crafted protocol messages to bypass authentication controls and interact with privileged server functions. No public proof-of-concept exploit code has been reported at the time of disclosure (Oracle Advisory).

Successful exploitation results in complete compromise of the Oracle WebLogic Server instance, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive data hosted on or accessible through the server, modify system configurations and application data, and disrupt service availability — effectively achieving full server takeover. Given WebLogic's typical role as an enterprise application server, exploitation could enable lateral movement into backend databases, connected enterprise systems, and internal networks (Oracle Advisory).

As of the disclosure date (September 15, 2026), there is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation. The vulnerability is rated as automatable by SSVC analysis, meaning exploitation can be scripted without human interaction. The EPSS score is approximately 0.33%, reflecting a currently low but non-trivial probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Oracle Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Oracle WebLogic Server instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 using tools such as Shodan, Censys, or Nmap, targeting default T3/IIOP ports (typically 7001 for HTTP/T3 and 7002 for HTTPS/T3S).
2. Protocol access: Establish a network connection to the WebLogic T3 or IIOP listener endpoint without providing any credentials, leveraging the missing authentication control in the Core component.
3. Authentication bypass: Send crafted T3 or IIOP protocol messages that exploit the improper authentication flaw (CWE-287/CWE-306) to interact with privileged server-side functions without authorization.
4. Server takeover: Leverage the unauthenticated access to execute arbitrary operations on the server, such as deploying malicious applications, executing remote code, exfiltrating sensitive data, or modifying server configurations to establish persistence (Oracle Advisory).

• Network: Unexpected or anomalous inbound connections to WebLogic T3/IIOP ports (default 7001, 7002) from untrusted or external IP addresses; unusual outbound connections from the WebLogic server process to unknown external hosts.
• Logs: WebLogic server logs (server.log) showing unauthenticated or failed authentication attempts on T3/IIOP endpoints; unexpected deployment or modification events in the admin console audit logs.
• File System: Newly created or modified WAR/EAR files in WebLogic deployment directories; unexpected scripts, binaries, or web shells in the WebLogic domain directory.
• Process: Unusual child processes spawned by the WebLogic JVM (e.g., cmd.exe, /bin/bash, curl, wget, powershell); unexpected Java processes initiating network connections.

Oracle has released security patches for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) as part of the September 2026 Critical Security Patch Update, and immediate application is strongly recommended. As a temporary workaround, restrict network access to WebLogic T3 and IIOP ports (typically 7001/7002) using firewall rules or network ACLs, allowing connections only from trusted, known IP addresses. Implement network segmentation to limit the exposure of WebLogic Server instances to untrusted networks. Monitor for suspicious T3/IIOP connection attempts as an additional detection measure (Oracle Advisory).

The vulnerability was noted in Oracle's September 2026 CSPU, which addressed 673 vulnerabilities across Oracle product families. Waratek published an analysis of the September 2026 Oracle CSPU, and BeyondMachines covered the broader patch release. Community discussion was observed on Mastodon shortly after disclosure. No significant independent researcher commentary or detailed technical write-ups specific to CVE-2026-70748 have been identified beyond standard vulnerability database entries (Oracle Advisory).