CVE-2026-101515

Modified Modified - Updated After Analysis

Oracle WebLogic Server Unauthenticated Data Access Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-11-06

Assigner: Oracle

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101515

EUVD

EUVD-2026-105928

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	weblogic_server	12.2.1.4.0
oracle	weblogic_server	14.1.1.0.0
oracle	weblogic_server	14.1.2.0.0
oracle	weblogic_server	15.1.1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle WebLogic Server affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It involves a flaw in the Centralized Thirdparty Jars component. An unauthenticated attacker can exploit it remotely via HTTP to gain unauthorized access to critical data or full access to all accessible data on the server.

Detection Guidance

This vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Detection involves checking the installed version of Oracle WebLogic Server against these affected versions. Use commands like 'java -jar wlsversion.jar' or check the server logs for version information.

Impact Analysis

The vulnerability allows attackers to access sensitive data stored on the Oracle WebLogic Server. This could lead to data breaches, unauthorized data exposure, or further compromise of the system if exploited. The impact is limited to data confidentiality as per the CVSS score.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected WebLogic Server versions may face compliance violations and potential penalties.

Mitigation Strategies

Apply the latest Oracle WebLogic Server patches immediately. Ensure network access controls restrict HTTP access to only trusted sources. Monitor for unusual data access patterns or unauthorized connections.

Hi! I’m here to help you understand CVE-2026-101515. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...