Oracle WebLogic Server: critical vulnerability

Oracle WebLogic Server

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.

Still cooking for Oracle WebLogic Server.

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 07:17 UTC
Identifiers: CVE-2026-70748
CVSS: 9.8
Source: news
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Oracle WebLogic Server: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: Oracle WebLogic Server
Ids: CVE-2026-70748

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.

## Steps
1. Search the repo, its CI and infra config for Oracle WebLogic Server. If present, report the version in use and whether it's affected.
2. Oracle WebLogic Server 15.1.x, 14.1.x, 12.2.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Oracle WebLogic Server 12.2 to 15.1 (3 lines) | not named in the CVE record | check the vendor advisory: https://www.oracle.com/security-alerts/cspusep2026.html | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-70748") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-70748 https://www.oracle.com/security-alerts/cspusep2026.html
https://pwned.coffee/i/vulnerability-in-the-oracle-weblogic-server-product-of-o-cve-2026-70748

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Oracle WebLogic Server 12.2.1.4.0 to 15.1.1.0.0 (3 lines) fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 27 Oct
The CVE record names no fix for 3 lines; the vendor’s advisory may: oracle.com
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA oracle) for CVE-2026-70748
Last checked: 27 Oct 2026, 07:17 UTC

Product	Affected	Fixed in	Source
Oracle WebLogic Server	12.2.1.4.0 to 15.1.1.0.0 (3 lines)	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee