CVE-2026-91502: 
Oracle WebLogic Server vulnerability analysis and mitigation

CVE-2026-91502 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via TLS to compromise the server, resulting in partial confidentiality, integrity, and availability impacts. It was disclosed on October 20, 2026, as part of Oracle's Critical Patch Update (CPU) for October 2026, with a CVSS v3.1 base score of 7.3 (High) (Oracle Advisory).

The vulnerability resides in the Core component of Oracle WebLogic Server and is exploitable over the network via TLS without requiring authentication or user interaction. The attack complexity is low, meaning no special conditions or configurations are needed to exploit it. Oracle has not publicly disclosed the specific root cause or CWE classification, which is consistent with Oracle's standard vulnerability disclosure policy of limiting technical detail. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized read access to a subset of WebLogic Server accessible data (partial confidentiality breach), unauthorized update, insert, or delete operations on some accessible data (partial integrity breach), and cause a partial denial of service to the WebLogic Server (partial availability impact). The scope is unchanged, meaning the impact is confined to the vulnerable WebLogic Server instance itself, though compromise of a WebLogic Server could expose application data and business logic hosted on the platform (Oracle Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Oracle Advisory). The EPSS score is reported at 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection has been noted by Qualys (detection ID 87622), indicating scanner-level awareness of the issue.

Oracle has released patches for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) as part of the October 2026 Critical Patch Update. Oracle strongly recommends applying the CPU patches as soon as possible. As a temporary measure, restricting network access to WebLogic Server TLS ports to trusted systems only and implementing network segmentation can reduce exposure. Monitoring WebLogic Server logs for suspicious connection attempts or anomalous data access patterns is also advised (Oracle Advisory).