CVE-2026-87300: 
Weblogic Server Proxy Plug-in for Apache HTTP Server vulnerability analysis and mitigation

CVE-2026-87300 is an authorization bypass vulnerability in the Oracle WebLogic Server Proxy Plug-In for Third-Party Web Servers, a component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 8.7 (High) (Oracle Advisory).

The vulnerability is classified as an authorization bypass (CWE not explicitly specified, but described as an authorization control failure) in the WebLogic Server Proxy Plug-In component used with third-party web servers. An unauthenticated attacker with network access via HTTP can exploit this flaw without requiring any privileges or user interaction, though exploitation is rated as "difficult" (high attack complexity). The scope change indicator in the CVSS vector (S:C) indicates that successful exploitation can impact products beyond the vulnerable component itself, potentially affecting other Oracle products connected through the proxy plug-in (Oracle Advisory).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical data accessible to the Oracle WebLogic Server Proxy Plug-in, as well as unauthorized read access to all data managed by the component. The vulnerability has a scope change, meaning exploitation may significantly impact additional Oracle products connected through the proxy, increasing the risk of lateral movement within an Oracle Fusion Middleware environment. Availability is not impacted, but confidentiality and integrity are both rated High (Oracle Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Oracle Advisory). The EPSS score is reported at 0.0, reflecting the current absence of observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. While no threat actor attribution is available, the high attack complexity requirement (AC:H) reduces the likelihood of opportunistic exploitation.

Oracle has released patches for all affected versions (12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0) as part of the October 2026 Critical Patch Update, and Oracle strongly recommends applying these patches as soon as possible (Oracle Advisory). As a temporary workaround prior to patching, network-level controls can be used to restrict HTTP access to the WebLogic Server Proxy Plug-in from untrusted sources, though Oracle notes this is not a long-term solution. Organizations should also monitor for unauthorized data modifications or anomalous access patterns on systems running vulnerable versions.