CVE-2026-91323: 
Oracle WebLogic Server vulnerability analysis and mitigation

CVE-2026-91323 is a critical remote code execution vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability was disclosed on October 20, 2026, as part of Oracle's October 2026 Critical Patch Update (CPU). It carries a CVSS v3.1 base score of 9.8 (Critical) (Oracle CPU Oct 2026).

The vulnerability resides in the Core component of Oracle WebLogic Server and is exploitable remotely over HTTP without authentication or user interaction, indicating a pre-authentication attack surface with no privilege requirements. The attack complexity is low, meaning exploitation does not require special conditions or configurations. While Oracle has not publicly disclosed the precise root cause or CWE classification, the vulnerability class and impact profile (full server takeover via unauthenticated HTTP) are consistent with deserialization or remote code execution flaws historically observed in WebLogic Core components. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle CPU Oct 2026).

Successful exploitation allows an unauthenticated remote attacker to achieve complete takeover of the affected Oracle WebLogic Server instance, resulting in high impacts to confidentiality, integrity, and availability. An attacker can read, modify, or delete sensitive data hosted on or accessible through the server, execute arbitrary code, and disrupt service availability. Given WebLogic's common role as an enterprise application server, compromise could facilitate lateral movement into backend databases, internal networks, and connected enterprise systems (Oracle CPU Oct 2026).

As of the time of disclosure (October 20, 2026), there is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation. The EPSS score is reported at 0.0, and no threat actor attribution has been identified. The vulnerability has not been listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. However, given the critical CVSS score, unauthenticated network exploitability, and Oracle WebLogic's history of being a high-value target, the risk of future weaponization is significant (Oracle CPU Oct 2026).

Oracle has released patches for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) as part of the October 2026 Critical Patch Update. Oracle strongly recommends applying these patches immediately. As a temporary workaround where patching is not immediately feasible, network-level controls should be implemented to restrict HTTP access to WebLogic servers to trusted IP ranges only, and unnecessary exposure of WebLogic administrative and application ports to the internet should be eliminated. Oracle explicitly cautions that network-based workarounds are not a long-term solution and do not address the underlying vulnerability (Oracle CPU Oct 2026).

The October 2026 Oracle CPU, which includes CVE-2026-91323, received coverage from security news outlets. SecurityOnline.info published articles covering both the broader Oracle Critical Patch Update and specific Oracle Fusion Middleware vulnerabilities addressed in this release. The vulnerability was also catalogued by VulDB and noted in threat intelligence aggregators. Given the critical nature of unauthenticated WebLogic RCE vulnerabilities and Oracle WebLogic's history as a frequent target, the security community has highlighted the urgency of patching (Oracle CPU Oct 2026).