Oracle WebLogic Server Exploitation – 20260326001¶
Overview¶
The WASOC has observed a recently published article detailing exploitation of vulnerabilities affecting Oracle WebLogic Server, a component of Oracle Fusion Middleware. The article details the attack data being collected from a high-interaction honeypot simulating a vulnerable Oracle WebLogic Server.
Attack attempts targeting this zero-day-like flaw were observed immediately following the public release of its exploit code, demonstrating the rapid weaponization of critical Oracle WebLogic vulnerabilities.
What is vulnerable?¶
| Product(s) Affected | Version(s) | CVE | CVSS | Severity |
|---|---|---|---|---|
| Oracle WebLogic Server | 14.1.2.0.0 14.1.1.0.0 12.2.1.4.0 12.2.1.3.0 12.2.1.2.0 12.2.1.1.0 12.1.3.0.0 10.3.6.0.0 |
CVE-2026-21962 CVE-2020-14882 CVE-2020-2551 CVE-2017-10271 |
10 9.8 9.8 7.5 |
Critical Critical Critical High |
What has been observed?¶
CISA has added one or more of the mentioned items to their Known Exploited Vulnerability catalog. The WASOC has not received any reports of exploitation of this vulnerability on Western Australian Government networks at the time of writing.
Recommendation¶
The WASOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframes (refer Patch Management):