Oracle has disclosed CVE-2026-91323, a critical (CVSS 9.8) flaw in the Core component of Oracle WebLogic Server that lets an unauthenticated attacker with network access over HTTP take over the server.
What Is It
CVE-2026-91323 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Oracle's description calls it "easily exploitable." An attacker with network access over HTTP can use it to compromise WebLogic Server without any credentials.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality / Integrity / Availability impact: High / High / High
The record has an exploitability subscore of 3.9 and an impact subscore of 5.9. NVD published it on October 20, 2026, and its status is currently "Received," so NVD has not yet finished its own analysis.
Why It Matters
A successful attack can result in full takeover of Oracle WebLogic Server. No authentication or user interaction is needed, the attack complexity is low, and it works over HTTP. That combination puts any reachable WebLogic instance at serious risk, especially one exposed to untrusted networks.
There is currently no CISA Known Exploited Vulnerabilities (KEV) entry for CVE-2026-91323. The supplied sources do not confirm active exploitation, and CISA has not issued a KEV required action or remediation deadline. Teams should still treat it as high priority because of the severity and the unauthenticated, network-reachable attack path.
What's Vulnerable
Oracle lists these supported versions of Oracle WebLogic Server as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
The NVD record does not yet include any CPE entries.
Patch Status
The NVD record links to Oracle's October 2026 Critical Patch Update advisory as its vendor reference. Administrators running any affected version should check that advisory for fix and patch guidance and apply the relevant updates as soon as possible. Until patches are applied, systems where the WebLogic HTTP interface is reachable from untrusted networks carry the most risk.
There is no CISA KEV entry for this CVE, so no federal required action or due date applies at this time.
Sources
- NVD: CVE-2026-91323
- Oracle Critical Patch Update Advisory, October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)