Oracle has disclosed CVE-2026-83038, a critical vulnerability in the TopLink Integration component of Oracle WebLogic Server that could let a low-privileged attacker with network access take over the server entirely.
What Is It
CVE-2026-83038 is a vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically the TopLink Integration component. Oracle describes it as easily exploitable: an attacker with only low privileges and network access over HTTP can compromise the server. No user interaction is required.
The CVSS 3.1 base score is 9.9 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That breaks down to network attack vector, low attack complexity, low privileges required, no user interaction, and a changed scope; with high impact to confidentiality, integrity, and availability. The exploitability subscore is 3.1 and the impact subscore is 6.0.
Why It Matters
Per Oracle's advisory, successful exploitation of this vulnerability can result in takeover of Oracle WebLogic Server. The scope change flag is the part worth reading twice: Oracle notes that while the vulnerability lives in WebLogic Server, attacks may significantly impact additional products beyond the vulnerable component itself. A compromised WebLogic instance is a middleware pivot point, not an isolated endpoint.
The combination of low attack complexity, network reachability over HTTP, and a low-privilege requirement puts this well within reach of any attacker who already holds a minimal foothold or a low-tier application credential.
The sources available for this record do not address exploitation status, and contain no evidence of active exploitation in the wild. Defenders who need a current exploitation determination should query CISA's Known Exploited Vulnerabilities catalog directly rather than infer status from the vendor advisory or the NVD entry.
What's Vulnerable
Oracle lists the following supported versions of Oracle WebLogic Server as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Patch Status
The CVE record was published 2026-09-15 with a vulnerability status of "Received," sourced from Oracle's security alert team. A "Received" status means NVD has not yet completed its own analysis, so enrichment data may change.
The single reference provided in the record is an Oracle Critical Security Patch Update advisory URL dated September 2026. One caveat on that: Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so a September-dated CPU advisory falls outside Oracle's normal release schedule. Administrators should locate this CVE through Oracle's current Critical Patch Update advisory index and confirm which quarterly release carries the fix, rather than relying on the referenced advisory date alone. Fixed-version and patch-application guidance comes from that advisory.
Sources
- Oracle Critical Security Patch Update Advisory (September 2026), https://www.oracle.com/security-alerts/cspusep2026.html
- NVD, CVE-2026-83038, https://nvd.nist.gov/vuln/detail/CVE-2026-83038