CVE-2026-91323

Summary

This vulnerability allows unauthenticated attackers to completely compromise Oracle WebLogic Server instances through HTTP requests, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw enables full system takeover with high impact on confidentiality, integrity, and availability.

Exploitability

The vulnerability is easily exploitable with no authentication required, allowing attackers to compromise the server through simple HTTP network access with minimal preconditions.

Blast radius

In a real-world scenario, this vulnerability could lead to complete system compromise of affected WebLogic servers, potentially exposing sensitive data and allowing attackers to execute arbitrary code on the target systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 as these are the affected versions and no specific fixed version is mentioned in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.