WebLogic Server vulnerabilities

102 known vulnerabilities in WebLogic Server from Oracle. 101 are rated high or critical, and 16 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-91502Oct 20, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-91323Oct 20, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.1 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-87302Oct 20, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-83399Oct 20, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.9 Critical severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-83038Sep 15, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged

• 10.0 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-83021Sep 15, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with ne

• 9.8 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-70757Sep 15, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-70756Sep 15, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-70748Sep 15, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60977Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker w

• 9.9 Critical severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60702Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with

• 8.6 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60699Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60698Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60696Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.1 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60680Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with

• 7.5 High severity

  Oracle WebLogic Server: Improper Authentication

  CVE-2026-60679Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker wit

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60672Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.1 High severity

  Oracle WebLogic Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-60415Aug 18, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker wi

• 7.2 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60529Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via H

• 7.6 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60528Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via H

• 7.1 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60527Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrast

• 8.8 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60343Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP

• 8.8 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60313Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with

• 8.1 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60312Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker wi

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60294Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.6 High severity

  Oracle WebLogic Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-60293Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60292Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60291Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.1 Critical severity

  Oracle WebLogic Server: Uncontrolled Resource Consumption

  CVE-2026-60208Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.8 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60207Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP

• 9.9 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60206Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60205Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60204Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.8 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60203Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60202Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.1 High severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60201Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker wi

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60200Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60199Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 9.8 Critical severity

  Oracle WebLogic Server: Missing Authentication for Critical Functionality

  CVE-2026-60198Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with

• 8.4 High severity

  Oracle WebLogic Server: Improper Access Control

  CVE-2026-60196Jul 21, 2026Oracle

  Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with access to the physical