Search CVEs, research… / diras.sa

CVE-2026-70756: pre-auth remote code execution in Oracle Oracle WebLogic Server

An unauthenticated remote attacker can fully compromise Oracle WebLogic Server over network-accessible management protocols; this is tracked as CVE-2026-70756. Affected releases include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw requires only network access to T3 or IIOP services and no valid credentials or user interaction. Successful exploitation can lead to complete takeover of the WebLogic Server, impacting confidentiality, integrity, and availability of hosted applications.

Published Updated Source: CVE Program, NVD, FIRST EPSS, Vendor advisory

CVSS 3.1
9.8CRITICAL
EPSS
0.00508
CWE
CWE-287
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: this allows unauthenticated remote compromise via T3/IIOP, so immediately reduce exposure of WebLogic management interfaces and apply vendor guidance as soon as patches are released.

What is CVE-2026-70756?

An unauthenticated remote attacker can fully compromise Oracle WebLogic Server over network-accessible management protocols; this is tracked as CVE-2026-70756. Affected releases include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw requires only network access to T3 or IIOP services and no valid credentials or user interaction. Successful exploitation can lead to complete takeover of the WebLogic Server, impacting confidentiality, integrity, and availability of hosted applications. The weakness is classified as CWE-287 (Improper Authentication).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Oracle Oracle WebLogic Server are affected?

BRANCHAFFECTEDFIXED
12.x12.2.1.4.0
14.x14.1.1.0.0
14.x14.1.2.0.0
15.x15.1.1.0.0

Is CVE-2026-70756 being exploited?

There are no public reports of exploitation as of 2026-09-30.

How to fix CVE-2026-70756

  1. Restrict or block external access to T3 and IIOP ports at network perimeter and firewalls
  2. Disable or restrict WebLogic administration interfaces to trusted networks where possible
  3. Monitor WebLogic logs and network traffic for unexpected connections on T3/IIOP and signs of unauthorized activity
  4. Follow Oracle advisories and apply vendor patches or configuration fixes when Oracle publishes them

Frequently asked questions

Is CVE-2026-70756 being actively exploited?

There are no public reports of exploitation as of 2026-09-30.

Which Oracle WebLogic Server versions are affected by CVE-2026-70756?

Affected releases listed are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

Is there a patch for CVE-2026-70756?

Oracle has not listed fixed versions for this issue; follow Oracle advisories for patch availability and apply them when released.

Does CVE-2026-70756 require authentication?

No, exploitation does not require authentication; an attacker only needs network access to T3 or IIOP services.

References