CVE-2026-70748

CVE-2026-70748 is a critical (CVSS 9.8) vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, that allows an unauthenticated remote attacker with network access to fully compromise the server. The flaw is triggered by sending crafted requests to the WebLogic T3 or IIOP protocol listeners, which are commonly enabled for Java client and RMI communications. A successful attack results in a complete takeover of Oracle WebLogic Server with high impact on confidentiality, integrity, and availability. All currently supported releases are affected — 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 — so any deployment exposing T3/IIOP to untrusted networks is at risk. The issue is not on CISA's KEV catalog and no public proof-of-concept is known, though remotely exploitable WebLogic flaws of this severity are frequently targeted once patch details circulate.

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2026-70748 to all WebLogic installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Until patched, block or strictly allow-list T3 and IIOP traffic at perimeter firewalls, and disable those listeners on servers that do not need them. Check any host with an exposed T3/IIOP port for indicators of compromise, such as unexpected WAR deployments, new administrative users, or modified server startup scripts.