CVE-2026-91502

highpriority · track · 29OT risk · elevatedEPSS 0.003 · 21 %ileDEFRNLUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.29% (21st) EPSS

CVSS 7.3 · high

Is it mine?

35 products

Check your exposure

Who says so?

3 sources

cert_bund · ncsc_nl · certfr

EPSS · scored 2026-10-27

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

cvss

Technical severity, 0–10. One row per scoring source.

7.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.7–7.3

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lprimary · secalert_us@oracle.com USexploitability 3.9 · impact 3.4

v3.16.7mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-266USLLM-inferredCWE-306US

affected products (35)

Products and version ranges known to be affected.

Fusion Middlewareall versionscert_bundDEcpe:/a:oracle:fusion_middleware:27.0.0
Fusion Middlewareall versionscert_bundDEcpe:/a:oracle:fusion_middleware:4.0.0-4.5.5
Fusion Middlewareall versionscert_bundDEcpe:/a:oracle:fusion_middleware:3.0.0-3.2.21
Oracle Fusion Middleware 12.2.1.4.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:12.2.1.4.0
Oracle Fusion Middleware 14.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.1.0.0
Oracle Fusion Middleware 14.1.2.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.0.0
Oracle Fusion Middleware 14.1.2.1.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:14.1.2.1.0
Oracle Fusion Middleware 15.1.1.0.0all versionscert_bundDEcpe:/a:oracle:fusion_middleware:15.1.1.0.0
Oracle Fusion Middleware 8.5.8all versionscert_bundDEcpe:/a:oracle:fusion_middleware:8.5.8
Oracle Access Manager≤ vers:unknown/*ncsc_nlNL
Oracle Business Process Management Suite≤ vers:unknown/*ncsc_nlNL
Oracle Coherence≤ vers:unknown/*ncsc_nlNL
Oracle Data Integrator≤ vers:unknown/*ncsc_nlNL
Oracle Fusion Middleware≤ vers:unknown/*ncsc_nlNL
Oracle Fusion Middleware Common Libraries And Tools≤ vers:unknown/*ncsc_nlNL
Oracle Fusion Middleware Control≤ vers:unknown/*ncsc_nlNL
Oracle Fusion Middleware MapViewer≤ vers:unknown/*ncsc_nlNL
Oracle Global Lifecycle Management NextGen OUI Framework≤ vers:unknown/*ncsc_nlNL
Oracle HTTP Server≤ vers:unknown/*ncsc_nlNL
Oracle Helidon≤ vers:unknown/*ncsc_nlNL

showing 20 of 35

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0448Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2026-10-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle WebCenter Content, Oracle Fusion Middleware (inclusief Helidon) en Oracle HTTP Server.
WID-SEC-W-2026-4078Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-10-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
CERTFR-2026-AVI-1355Multiples vulnérabilités dans Oracle WeblogicFrançais2026-10-21vendor · certfrFR

sources

Which sources assert this record, and when.

cert_bund ncsc_nl certfr NVD CVE.org MITRE

published 2026-10-20modified 2026-10-24

references (1) nvd

External citations — patches, advisories, analysis.

https://www.oracle.com/security-alerts/cpuoct2026.html

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan