CVE-2026-91502 Oracle Corporation CVE debrief

Who should care

Oracle WebLogic Server administrators, security teams responsible for patch management, and IT personnel managing critical infrastructure should be aware of this vulnerability and take necessary actions to prevent exploitation. The vulnerability affects multiple versions of Oracle WebLogic Server, and its exploitation could lead to unauthorized data access and partial denial of service.

Why it matters

CVE-2026-91502 is a high-severity vulnerability in Oracle WebLogic Server that allows unauthenticated attackers to compromise the server, potentially leading to data breaches and service disruptions. Oracle WebLogic Server administrators should urgently assess exposure and apply patches to prevent exploitation.

• Potential unauthorized data access and modification
• Partial denial of service impacting server availability
• Need for urgent patching to prevent exploitation
• Potential for lateral movement within compromised environments

Technical summary

The vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows unauthenticated attackers with network access via TLS to compromise the server, potentially leading to unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 Base Score of 7.3, indicating a high severity level. Oracle WebLogic Server administrators should urgently assess exposure and apply patches to prevent exploitation.

Defensive priority

High priority for Oracle WebLogic Server administrators to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure of Oracle WebLogic Server instances to this vulnerability
• Verify and apply patches or updates provided by Oracle
• Monitor server logs for suspicious activity
• Consider implementing compensating controls to mitigate potential impacts
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor confirmation and additional context are limited. The vulnerability has been identified in multiple versions of Oracle WebLogic Server, including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Defenders should verify the affected scope and apply patches or updates provided by Oracle. The CVE record was published on 2026-10-20T22:20:54.670Z and has not been modified since then. The NVD entry provides additional details on the vulnerability, including its

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.