CVE-2026-87302: 
Oracle WebLogic Server vulnerability analysis and mitigation

CVE-2026-87302 is an authorization bypass vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the server, resulting in unauthorized read and write access to critical data. It was disclosed on October 20, 2026, as part of Oracle's Critical Patch Update (CPUOct2026), with a CVSS v3.1 base score of 9.1 (Critical) (Oracle Advisory).

The vulnerability is classified as an Authorization Bypass (CWE not explicitly specified by Oracle, but consistent with improper access control) in the Core component of Oracle WebLogic Server. An unauthenticated remote attacker can exploit this flaw over HTTP with low attack complexity, requiring no user interaction or special privileges. The attack vector is network-based, making internet-facing WebLogic instances particularly at risk. Oracle has not publicly disclosed the specific technical root cause or exploitation mechanics beyond the risk matrix description (Oracle Advisory).

Successful exploitation allows an unauthenticated attacker to gain full read access to all data accessible by Oracle WebLogic Server (high confidentiality impact) and to create, delete, or modify critical data (high integrity impact). Availability is not directly impacted according to the CVSS scoring. Given WebLogic Server's typical role as an enterprise application server handling sensitive business data, exploitation could expose credentials, application data, and configuration secrets, and could enable further lateral movement within enterprise environments (Oracle Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Oracle Advisory). The EPSS score is reported as 0.0, reflecting the early stage of public awareness (Oracle Advisory). The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of disclosure. No threat actor attribution has been reported. However, the low attack complexity and lack of authentication requirements make this vulnerability highly attractive for future exploitation.

Oracle has released patches for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) as part of the October 2026 Critical Patch Update. Oracle strongly recommends applying these patches immediately. As a temporary workaround, restrict network access to WebLogic Server HTTP endpoints to trusted IP ranges only, and monitor WebLogic Server logs for suspicious activity patterns. Oracle cautions that network-blocking workarounds may break application functionality and should not be considered a long-term solution (Oracle Advisory).

The vulnerability was noted in security community coverage of Oracle's October 2026 CPU, which included 1,295 new security patches across Oracle product families. Security news outlets such as Security Online Info covered the broader Oracle Fusion Middleware vulnerabilities disclosed in this CPU cycle. The October 2026 CPU was also highlighted for containing multiple unauthenticated high-severity CVEs affecting WebLogic Server and other Fusion Middleware products (Oracle Advisory).