Critical · published January 21, 2026
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.
🚨 An unauthenticated HTTP request is all it takes to exploit this vulnerability in the Oracle HTTP Server! 🔥 Think of it like a hotel front desk that lets anyone through the door without verifying their identity — once inside, they can access guest records, change bookings, or even delete reservations without a trace! An attacker could waltz in and gain unauthorized access to critical data or even modify it, potentially leading to a total compromise of the Oracle HTTP Server and Weblogic Server Proxy Plug-in. This could open the floodgates to disastrous data breaches, data loss, or unauthorized changes that could affect all connected services!
Think of it like a hotel front desk that lets anyone through the door without verifying their identity — once inside, they can access guest records, change bookings, or even delete reservations without a trace! This vulnerability in the Oracle HTTP Server and Weblogic Server Proxy Plug-in allows unauthenticated attackers with network access to compromise the server, leading to unauthorized creation, deletion, or modification of data. It impacts supported versions including 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0.
An attacker could waltz in and gain unauthorized access to critical data or even modify it, potentially leading to a total compromise of the Oracle HTTP Server and Weblogic Server Proxy Plug-in. This could open the floodgates to disastrous data breaches, data loss, or unauthorized changes that could affect all connected services! Patch to the latest version immediately, specifically targeting versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, to close this critical vulnerability. Also, assess your firewall and access controls to limit unauthorized network access to your Oracle servers. 🚀 You've got this! Fixing this vulnerability is key to protecting your systems and ensuring your data stays safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| oracle/http_server | all versions | — |
| oracle/http_server | all versions | — |
| oracle/http_server | all versions | — |
| oracle/weblogic_server_proxy_plug-in | all versions | — |
| oracle/weblogic_server_proxy_plug-in | all versions | — |
| oracle/weblogic_server_proxy_plug-in | all versions | — |