CVE-2026-21992 – Oracle WebLogic Remote Code Execution

CVSS 9.8 CRITICAL

“One exposed enterprise service can hand over your entire infrastructure.”

Oracle addressed CVE-2026-21992 in WebLogic Server, a critical vulnerability that allows remote code execution without authentication. The flaw affects core application server components and can be exploited over the network, giving attackers the ability to execute arbitrary code and fully compromise affected systems.

CVE-2026-21992 has a CVSS score of 9.8, which is Critical severity. There is no verified evidence of active exploitation or publicly available proof-of-concept code. The patch closes the remote execution path and strengthens input validation within affected services, reducing the risk of full system takeover.

Key Details

Affected Product
Oracle Identity Manager
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
CWE Classification
CWE-306
Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.