CVE-2026-87302 is a critical (CVSS 3.1 9.1) flaw in the Core component of Oracle WebLogic Server that an unauthenticated attacker with HTTP access can exploit to read, create, modify or delete critical data.
What Is It
CVE-2026-87302 affects Oracle WebLogic Server, part of Oracle Fusion Middleware, in its Core component. Oracle calls it "easily exploitable." An attacker needs no authentication and only network access over HTTP to compromise the server.
Oracle ([email protected]) published the record to NVD on 2026-10-20. Its NVD status is currently "Received," so NVD has not yet added its own analysis.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Impact: High confidentiality and high integrity, no availability impact
A successful attack can give an attacker unauthorized access to critical data, or complete access to all data WebLogic Server can reach. It can also let the attacker create, delete or modify that data. The exploitability subscore is 3.9 (the maximum), so remote, unauthenticated attackers face few barriers.
Exploitation status: Defenders should check CISA's Known Exploited Vulnerabilities (KEV) catalog for the current status of CVE-2026-87302.
What's Vulnerable
Oracle lists these supported versions of Oracle WebLogic Server as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
The NVD record does not list any CPE entries yet.
Patch Status
The NVD record references Oracle's October 2026 Critical Patch Update (CPU) advisory. Administrators running any affected version should read that advisory for fix details and apply the October 2026 CPU patches for WebLogic Server.
The flaw is network-reachable and needs no authentication, so internet-exposed WebLogic HTTP endpoints should be patched first.