{"id":11966,"date":"2026-09-21T14:48:18","date_gmt":"2026-09-21T20:48:18","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-106-rce-in-oracle-weblogic-server-cve-2026-70757\/"},"modified":"2026-09-29T10:59:09","modified_gmt":"2026-09-29T16:59:09","slug":"alert-2026-106-rce-in-oracle-weblogic-server-cve-2026-70757","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-106-rce-in-oracle-weblogic-server-cve-2026-70757\/","title":{"rendered":"Alert 2026-106 RCE in Oracle WebLogic Server \u2014 CVE\u20112026\u201170757"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n

Oracle identifies these supported versions as affected:<\/p>\n\n

Product<\/strong><\/td>Component<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
Oracle WebLogic Server<\/strong><\/td>Core<\/td>12.2.1.4.0<\/td><\/tr>
Oracle WebLogic Server<\/strong><\/td>Core<\/td>14.1.1.0.0<\/td><\/tr>
Oracle WebLogic Server<\/strong><\/td>Core<\/td>14.1.2.0.0<\/td><\/tr>
Oracle WebLogic Server<\/strong><\/td>Core<\/td>15.1.1.0.0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The exact patch availability, patch<\/em> number, and prerequisites must be confirmed in My Oracle Support (MOS)<\/strong>, using the September 2026 Critical Patch Update and the patch matrix corresponding to the environment.<\/p>\n\n

Description<\/h2>\n\n

A critical vulnerability was identified in the Core<\/strong> component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw has a CVSS 9.8 score, identified as CVE\u20112026\u201170757<\/strong> and allows an unauthenticated remote attacker, with network access to the T3<\/strong> or IIOP<\/strong> protocols, to fully compromise a vulnerable WebLogic Server instance.<\/p>\n\n

The vulnerability was fixed as part of the September 2026 Oracle Critical Patch Update (CPU)<\/strong>. No authentication, user interaction, or complex exploitation conditions are required; therefore, WebLogic servers that have T3, IIOP, administrative consoles, or applications exposed to the Internet or accessible from untrusted networks should be prioritized.<\/p>\n\n

Solution<\/h2>\n\n

The definitive remediation consists of applying the corresponding patch from the September 2026 Oracle Critical Patch Update<\/strong> for CVE\u20112026\u201170757. Patch downloads and detailed installation steps are available for authorized customers through My Oracle Support<\/strong>.<\/p>\n\n

https:\/\/support.oracle.com\/signin<\/a><\/p>\n\n

No mitigation is identified that completely eliminates the vulnerability. Blocking T3\/IIOP, disabling unused IIOP, and connection filters temporarily reduce the attack surface, but do not replace the official patch.<\/p>\n\n

After updating, validate that:<\/p>\n\n

    \n
  1. The WebLogic domain inventory has the patch applied.<\/li>\n\n\n\n
  2. T3\/IIOP ports are only available to authorized sources.<\/li>\n\n\n\n
  3. The administrative console is not directly exposed to the Internet.<\/li>\n\n\n\n
  4. Applications and datasources<\/em> operate correctly after the restart.<\/li>\n\n\n\n
  5. Unauthorized changes and possible signs of prior exploitation have been reviewed.<\/li>\n<\/ol>\n\n

    Additional information:<\/h2>\n\n