Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services)
Oracle Corporation · WebLogic Server
A critical vulnerability in Oracle WebLogic Server allows an unauthenticated attacker with network access via HTTP to take over the server. It affects supported versions 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 49 days before it was disclosed. Public exploit code (Exploit-DB) appeared 7 months after disclosure.
- First seen exploitedVulnCheck KEV evidence49 days before
- Disclosedday 0
- Public exploit codeExploit-DB+7 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Command and Scripting InterpreterT1059 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Not named in any threat report yetAlso mentioned in 2 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- CVE Data16 Feb 2026
- 2022 UNIT 42 NETWORK THREAT TRENDS RESEARCH REPORT30 Aug 2022