CERT-FR Flags Multiple Oracle WebLogic CVEs
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CERT-FR advisory lists numerous vulnerabilities in Oracle WebLogic Server and Proxy Plug-in enabling remote DoS, data integrity and confidentiality breaches.
CERT-FR has published an advisory summarizing Oracle's October 2026 Critical Patch Update (CPU) for WebLogic products, covering a large set of CVEs affecting Oracle WebLogic Server Proxy Plug-in (versions 12.2.1.4.0 and 14.1.2.0.0) and Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.2.0.0, and 15.1.1.0.0). The vulnerabilities collectively allow an attacker to cause remote denial of service, and to compromise the confidentiality and integrity of data. No specific exploitation details, proof-of-concept code, or in-the-wild exploitation are mentioned in the advisory.
The advisory does not provide technical details per CVE, is limited to risk categorization and affected product/version listing, and directs readers to Oracle's own CPU bulletin (cpuoct2026) for patch information. Given WebLogic's common use in enterprise Java application environments, organizations running the affected versions should prioritize applying Oracle's October 2026 patches.
Defenders should inventory WebLogic Server and Proxy Plug-in deployments against the listed affected versions, apply the Oracle CPU patches promptly, and monitor for anomalous WebLogic traffic or service disruptions pending patch deployment. As this is a batch CVE disclosure tied to a vendor's regular patch cycle rather than evidence of active exploitation, treat as a standard patch management priority unless further intelligence indicates in-the-wild attacks.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1355
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,853 reports from 140 sources, 513 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs