CVE-2026-91323

waiting for further signals

GHSA-x85m-p8wc-pg7r ↗EUVD-2026-106577 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Oracle Corporation Oracle WebLogic Server 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0; 15.1.1.0.0

ETK-2026-2255, permanent identifier

cvss9.8cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

2h 51msince last run

14mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+3h56m

+2h

+6h

+8h

+10h

+12h

description

Oracle WebLogic Server Core versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. An attacker who can reach a vulnerable server over HTTP without authenticating may be able to take control of that server.

mitigation

Install the Oracle October 2026 Critical Patch Update applicable to WebLogic Server. Until updates are deployed, restrict HTTP access to the service to trusted networks and authorized clients.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

14m

cve.org record, t = 0

2026-10-20 21:25Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-20 21:25Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-x85m-p8wc-pg7r
2026-10-20 21:25Z
cve.org record for CVE-2026-91323
cve_org · https://www.cve.org/CVERecord?id=CVE-2026-91323

this entry in the feed

GET /api/v1/feed/CVE-2026-91323

{
  "etk_id": "ETK-2026-2255",
  "cve_id": "CVE-2026-91323",
  "display_id": "CVE-2026-91323",
  "ghsa_id": "GHSA-x85m-p8wc-pg7r",
  "euvd_id": "EUVD-2026-106577",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated HTTP server takeover in Oracle WebLogic Server",
  "summary": "Oracle WebLogic Server Core versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. An attacker who can reach a vulnerable server over HTTP without authenticating may be able to take control of that server.",
  "mitigation": "Install the Oracle October 2026 Critical Patch Update applicable to WebLogic Server. Until updates are deployed, restrict HTTP access to the service to trusted networks and authorized clients.",
  "vendor": "Oracle Corporation",
  "product": "Oracle WebLogic Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "12.2.1.4.0",
        "14.1.1.0.0",
        "14.1.2.0.0",
        "15.1.1.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Oracle WebLogic Server",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.13019205,
  "t0_at": "2026-10-20T21:25:18.765000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-20T21:25:18.765000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T21:25:18.765000+00:00",
      "url": "https://github.com/advisories/GHSA-x85m-p8wc-pg7r"
    }
  }
}

published 2026-10-21 01:06Z
last change 2026-10-21 03:26Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.