External risk intelligence

Oracle WebLogic Server T3 IIOP Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-70756

Oracle WebLogic Server is a middleware product frequently deployed as an internet-facing application server, API gateway, or edge service. The vulnerability is reachable via T3 or IIOP protocols, which are commonly exposed in these deployment patterns, making it plausible for the service to be accessible from the internet.

Authentication Bypass

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebLogic Server, a widely used middleware product. This issue, if exploited, could allow an attacker to gain complete control over the affected server. The primary concern is to determine if our organization utilizes the specific versions of Oracle WebLogic Server that are vulnerable and whether they are exposed to external access.

Unauthenticated attackers can take over WebLogic servers.
Critical flaw affects widely used Oracle middleware.
Confirm Oracle WebLogic Server relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target Oracle WebLogic Server through network access without needing any credentials. Exploiting this vulnerability could lead to a complete takeover of the server.

No authentication required.
Network access via T3, IIOP.
Full server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect Oracle WebLogic Server, potentially allowing an attacker to gain complete control over the server. The attacker could exploit this by sending specially crafted requests over the network, without needing any prior authentication. When supported by the advisory, this could impact the confidentiality, integrity, and availability of the server and any data it processes.

Server takeover.
Network access to T3, IIOP.
Full system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this Oracle WebLogic Server vulnerability. The first practical move involves identifying all instances of the affected Oracle WebLogic Server, confirming their reachability and business criticality, and then assigning ownership to the appropriate team for risk-based remediation planning.

Verify ownership of affected WebLogic instances.
Confirm network reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an enterprise-grade Java middleware platform. It serves as the foundational environment where organizations host, run, and manage large-scale business applications, APIs, and microservices.

What does CWE-287 and CWE-306 mean for CVE-2026-70756?

These codes identify improper authentication and missing authentication for critical functions. In this vulnerability, they mean the server fails to verify who is connecting, allowing an attacker to bypass security checks and issue unauthorized commands.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted network requests to the server using the T3 or IIOP protocols. The flaw does not require the attacker to have a valid user account or password to successfully interact with the service.

Do I need to worry about this if my server is internal?

Halo Surface Signal notes that WebLogic is often deployed as an internet-facing gateway, increasing the risk. While internet-exposed instances are at higher risk, any server accessible via your network using T3 or IIOP could be a target.

When should I prioritize fixing this server?

Prioritize this immediately. Begin by creating an inventory of all instances running the affected versions to confirm their business role and network accessibility, then coordinate with infrastructure teams to apply vendor-supplied updates.

References

www.oracle.com/security-alerts/cspusep2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.