CVE-2026-83399 is a critical (CVSS 9.8) flaw in the Core component of Oracle WebLogic Server that lets an unauthenticated attacker with network access over T3 or IIOP take over the server.
What Is It
CVE-2026-83399 affects the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Oracle describes it as "easily exploitable." An unauthenticated attacker with network access through the T3 or IIOP protocols can use it to compromise WebLogic Server. A successful attack can result in full takeover of the server.
Oracle ([email protected]) published the record to NVD on 2026-10-20. Its NVD status is currently "Received," which means NVD has not yet done its own analysis.
Why It Matters
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which works out to:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Impact: High confidentiality, integrity and availability impact
The base score is 9.8 (CRITICAL), with an exploitability subscore of 3.9 and an impact subscore of 5.9. According to the CVSS vector, exploitation needs no credentials and no user action. The advisory names the attack path (network access over T3 or IIOP) and the affected versions. It does not say whether particular configurations change exposure. Deployments that run an affected version and expose T3 or IIOP to untrusted networks are the most likely targets.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. KEV does not currently confirm active exploitation, and CISA has not issued a required action or due date.
What's Vulnerable
Vendor: Oracle Corporation Product: Oracle WebLogic Server (Oracle Fusion Middleware, component: Core)
Oracle lists these supported versions as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
The NVD record does not yet include any CPE entries.
Patch Status
NVD points to Oracle's October 2026 Critical Patch Update advisory as the reference for this vulnerability. Administrators running any affected version should check that advisory for fix details and apply the relevant patches. Because the attack runs over T3 and IIOP, also check which systems can reach those protocols on your WebLogic deployments.
There is no CISA KEV remediation deadline, because the CVE is not in the KEV catalog.