External risk intelligence

Oracle WebLogic Server Authentication Bypass Leads to Full Server Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-70757

Oracle WebLogic Server is a widely used application server frequently deployed at the internet edge to host public-facing web applications and services. The protocols involved, T3 and IIOP, are core communication methods for WebLogic, and its role as an application platform makes it a common target for internet-facing exposure.

Authentication Bypass

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebLogic Server, a core component for managing applications. This issue is easily exploitable by unauthenticated attackers over the network, potentially allowing them to take complete control of the affected servers. The primary concern is confirming if our organization utilizes this specific technology and is therefore exposed.

Unauthenticated network access can seize control.
Critical server vulnerability requires attention.
Confirm exposure; investigate if deployed.

Attack Path

How an attacker could exploit the issue

An attacker can reach Oracle WebLogic Server over the network without needing any credentials by using the T3 or IIOP protocols. This exposure targets the Core component of the server, potentially leading to a complete takeover of the system.

Network access required.
T3 or IIOP protocols trigger.
Full system takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to take complete control of an Oracle WebLogic Server. This is possible because the attacker can access the server over the network using T3 or IIOP protocols, which are commonly used for communication within WebLogic environments. Such a takeover could expose all data and system functions managed by the affected server.

Server control and data access.
Network access via T3 or IIOP.
Complete system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners, infrastructure teams, and potentially vendor management teams are likely responsible for addressing this vulnerability in Oracle WebLogic Server. The first practical step is to identify all instances of the affected technology, confirm their exposure and criticality, and then determine the accountable owner to plan remediation based on the assessed risk.

Identify affected WebLogic instances and ownership.
Verify network reachability and business criticality.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an enterprise-grade application server used to build, deploy, and run large-scale Java web applications. It serves as a foundational platform for managing business logic and services, often acting as the middleware that connects backend databases to user-facing applications.

What does CVE-2026-70757 mean for system security?

This vulnerability involves an authentication bypass, specifically categorized under improper authentication (CWE-287) and missing authentication for critical function (CWE-306). It means an attacker can circumvent standard security checks to perform unauthorized actions, effectively allowing them to command the server without providing valid credentials.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending malicious requests over the network specifically using the T3 or IIOP protocols, which are core communication channels for WebLogic. The vulnerability does not require any prior user authentication; however, it is limited to scenarios where these specific protocol ports are reachable and open for communication.

Do I need to worry if my server is not on the internet?

According to Halo Surface Signal, this software is often placed at the internet edge to support public services, increasing risk. While internal servers are theoretically less reachable, any instance with these protocols enabled and accessible on a network path could be at risk if an attacker reaches that internal segment.

What should I do first to manage this threat?

Your first step is to perform an inventory of your environment to locate all running versions of WebLogic Server. Once identified, verify if they match the affected versions (12.2.1.4.0 through 15.1.1.0.0). Coordinate with your infrastructure team to assess the criticality of these instances and prepare for official vendor updates.

References

www.oracle.com/security-alerts/cspusep2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.