CVE-2026-70757

A critical flaw (CVSS 9.8) in the Core component of Oracle WebLogic Server allows an unauthenticated remote attacker with network access to the T3 or IIOP protocols to fully compromise the server, resulting in complete takeover of the WebLogic instance and its hosted applications. Exploitation requires no privileges, credentials, or user interaction, and a successful attack impacts confidentiality, integrity, and availability. All currently supported releases are affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw is not yet in CISA's KEV catalog and no public proof-of-concept is known, but unauthenticated T3/IIOP vulnerabilities in WebLogic have historically been rapidly weaponized after disclosure, so patching should not be delayed.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-70757 to every affected WebLogic installation (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) as soon as it is available. Until patched, block or tightly restrict T3 and IIOP traffic at perimeter firewalls and use WebLogic connection filters so only trusted hosts can reach those protocols. Review logs and server state for unexpected T3/IIOP connections, newly deployed applications, or unfamiliar administrative accounts.