/
← Voltar ao feed
medium

CERT-FR flags multiple Oracle WebLogic Server vulnerabilities in the October 2026 Critical Patch Update

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 13 horas

CERT-FR has published advisory CERTFR-2026-AVI-1355 on multiple vulnerabilities in Oracle WebLogic Server and the WebLogic Server Proxy Plug-in. The flaws allow a remote attacker to cause a denial of service and to breach the confidentiality and integrity of data. The advisory relies on the Oracle Critical Patch Update bulletin cpuoct2026 of 20 October 2026. It does not mention active exploitation, IOCs or attribution.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1355 covers multiple vulnerabilities (about 35 CVEs, including CVE-2023-43622, CVE-2025-7962 and CVE-2026-41838 to CVE-2026-41855) in Oracle WebLogic Server and the WebLogic Server Proxy Plug-in. A remote attacker can cause denial of service and breach data confidentiality and integrity. The advisory gives no CVSS scores, does not map impact to individual CVEs and does not state the required privileges or configuration. Affected: WebLogic Server 12.2.1.4.0, 14.1.2.0.0 and 15.1.1.0.0; Proxy Plug-in 12.2.1.4.0 and 14.1.2.0.0. Fixes are in Oracle's cpuoct2026 bulletin of 20 October 2026.

Como funciona

The articles do not describe how any of these flaws work. They only say that a remote attacker can reach the affected WebLogic Server or Proxy Plug-in components and cause denial of service or access or alter data. The affected component and the failing step for each CVE are not given.

Por que é vulnerável

The articles do not state the root cause of any of the CVEs. The advisory only points to the vendor bulletin for the patches, so what each fix changes is not known from these sources.

Como foi descoberta

The flaws were disclosed through Oracle's quarterly Critical Patch Update, bulletin cpuoct2026 of 20 October 2026, and CERT-FR republished them in its advisory on 21 October 2026. The articles do not say who found the flaws or how. The advisory does not mention active exploitation, IOCs or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 12:18.

Detalhes técnicos

  • Affected: Oracle WebLogic Server 12.2.1.4.0, 14.1.2.0.0 and 15.1.1.0.0.
  • Affected: Oracle WebLogic Server Proxy Plug-in 12.2.1.4.0 and 14.1.2.0.0.
  • The advisory references about 35 CVEs, including CVE-2023-43622, CVE-2025-7962 and CVE-2026-41838 to CVE-2026-41855. It gives no CVSS scores and does not map impact to individual CVEs.

Remediação

  • Apply the patches listed in the Oracle bulletin cpuoct2026 of 20 October 2026.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 23/10 12:01 primeiro registro

    CERT-FR flags multiple Oracle WebLogic Server vulnerabilities in the October 2026 Critical Patch Update

    ler a análise desta fonte

    CERT-FR has published advisory CERTFR-2026-AVI-1355 on multiple vulnerabilities in Oracle WebLogic Server and the WebLogic Server Proxy Plug-in. The flaws allow a remote attacker to cause a denial of service and to breach the confidentiality and integrity of data. The advisory relies on the Oracle Critical Patch Update bulletin cpuoct2026 of 20 October 2026. It does not mention active exploitation, IOCs or attribution.

    Technical Details

    • Affected: Oracle WebLogic Server 12.2.1.4.0, 14.1.2.0.0 and 15.1.1.0.0.
    • Affected: Oracle WebLogic Server Proxy Plug-in 12.2.1.4.0 and 14.1.2.0.0.
    • The advisory references about 35 CVEs, including CVE-2023-43622, CVE-2025-7962 and CVE-2026-41838 to CVE-2026-41855. It gives no CVSS scores and does not map impact to individual CVEs.

    Remediation

    • Apply the patches listed in the Oracle bulletin cpuoct2026 of 20 October 2026.