CVE-2026-83038

CVE-2026-83038 is a critical (CVSS 9.9) vulnerability in the TopLink Integration component of Oracle WebLogic Server, part of Oracle Fusion Middleware. A remote attacker who already holds low-privileged credentials for the server and has HTTP network access can exploit the flaw easily, and a successful attack results in a complete takeover of Oracle WebLogic Server. The CVSS vector includes a scope change (S:C), meaning compromise of WebLogic can significantly impact additional products beyond the vulnerable component itself, with high impact on confidentiality, integrity, and availability. Affected deployments are those running WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. As of this analysis, the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so there is no confirmed in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83038 to all WebLogic Server installations running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Because exploitation requires only low-privileged HTTP access, restrict management and application HTTP endpoints to trusted networks/VPNs, enforce strong authentication and least-privilege on all WebLogic accounts, and audit low-privilege accounts for abuse. Review servers for signs of post-exploitation such as unexpected deployments, scheduled jobs, or new OS-level users, since successful attacks lead to full server takeover with scope change to adjacent products.