Vulnerability record/PUBLISHED/Published Oct 20, 2026 21:25:18 UTC

CVE-2026-91323

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Base score9.8/ 10

SeverityCriticalCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityCritical

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionNoneUI

ScopeUnchangedS

Confidentiality impactHighC

Integrity impactHighI

Availability impactHighA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityoracle

Last updatedOct 27, 2026 03:56:04 UTC

PublishedOct 20, 2026 21:25:18 UTC

ReservedSep 14, 2026 22:10:16 UTC