External risk intelligence

Oracle WebLogic Server Core Vulnerability Allows Full Server Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-70748

Oracle WebLogic Server is commonly deployed as an internet-facing application server or middleware component. The vulnerability is reachable via T3 and IIOP protocols, which are frequently exposed when these servers are configured to support remote connectivity in enterprise web application environments.

Authentication Bypass

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Oracle WebLogic Server, a widely used product for enterprise applications. This issue is easily exploitable by an unauthenticated attacker over the network, potentially leading to a complete takeover of the server and impacting confidentiality, integrity, and availability. The main concern is to confirm if this technology is in use within our environment.

Unauthenticated network access can take over servers.
This affects critical business application middleware.
Confirm relevance and exposure to this threat.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by connecting to an exposed Oracle WebLogic Server over the network. Because the attack requires no authentication and can be initiated remotely, an attacker could use protocols like T3 or IIOP to interact with the server's core components. Successful exploitation of this vulnerability could grant the attacker complete control over the affected server.

Attacker has network access.
Attacker triggers vulnerability remotely.
Complete server takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers with network access to Oracle WebLogic Server could potentially compromise the entire server when using the T3 or IIOP protocols. This could affect the confidentiality, integrity, and availability of the server and any data it manages.

Server takeover.
Network access via T3, IIOP.
Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Oracle WebLogic Server is likely to impact application owners and infrastructure teams responsible for its deployment and maintenance. The immediate priority is to identify all instances of the affected product, determine their network exposure and business criticality, and pinpoint the accountable owner for each instance before planning remediation.

Application owners should investigate.
Verify network reachability and business impact.
Plan phased remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is a middleware platform used to host, deploy, and manage complex enterprise Java applications. It functions as the infrastructure layer where business logic and web services execute, allowing organizations to run large-scale, distributed software environments.

What does CVE-2026-70748 mean for server security?

This vulnerability involves improper authentication and a lack of required authorization. Specifically, it belongs to the CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) weakness classes. It allows an attacker to bypass security checks and gain full control over the server without needing any login credentials.

How is CVE-2026-70748 triggered?

An attacker triggers this by sending malicious requests to the server using the T3 or IIOP protocols. These protocols are part of the server's communication framework. It is important to note that actions performed through other standard web traffic, such as HTTP or HTTPS, do not serve as the direct trigger for this specific security defect.

Is my server at risk from this vulnerability?

Halo Surface Signal indicates that Oracle WebLogic Server is frequently deployed as an internet-facing component. If your server is configured to support remote connectivity via T3 or IIOP and is reachable from outside your internal network, it is at higher risk. Internal-only instances remain vulnerable if an attacker gains entry to your network.

How should I respond to this threat?

Your first step is to locate all active installations of the affected Oracle WebLogic versions within your environment. Once identified, evaluate their network accessibility and prioritize those exposed to public traffic. Coordinate with your application and infrastructure teams to verify business criticality and schedule the necessary security updates.

References

www.oracle.com/security-alerts/cspusep2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.