Oracle Patches Over 150 Fusion Middleware Flaws
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
Oracle's latest Critical Patch Update fixes over 150 vulnerabilities across WebLogic, SOA Suite, Identity Manager, Access Manager and related Fusion Middleware products, several rated CVSS 9.8-10.0.
NCSC-NL has issued a high-priority advisory summarizing Oracle's Critical Patch Update covering Oracle Fusion Middleware and related products, including Oracle SOA Suite, WebLogic Server, Data Integrator, Identity Manager, Access Manager, WebCenter Content, Fusion Middleware (including Helidon), and Oracle HTTP Server. The update addresses a very large number of vulnerabilities spanning insecure deserialization, missing or broken authentication and authorization, flaws in network protocols (HTTP, HTTP/2, SOAP, T3, IIOP, LDAP), and issues in third-party cryptographic/parsing libraries such as Bouncy Castle and Jackson-databind.
Multiple flaws carry CVSS scores up to 10.0 and allow unauthenticated network-based exploitation leading to arbitrary code execution, full system compromise, unauthorized data access or manipulation, denial of service via resource exhaustion, privilege escalation, and cross-site scripting/spoofing. NCSC-NL notes that no public proof-of-concept exploit code is currently known, but given the widespread deployment of these Oracle products and the nature of the flaws (several network-reachable, pre-auth, and deserialization-based), it expects a short-term increase in scanning and exploitation attempts.
Defenders running any of the affected Oracle Fusion Middleware components should prioritize applying Oracle's October Critical Patch Update immediately, focusing first on internet-facing WebLogic, Access Manager, and HTTP Server instances, and monitor for anomalous T3/IIOP/LDAP traffic, unexpected deserialization activity, and unauthorized administrative access as indicators of attempted exploitation.
Mentioned in this report
Detection guidance
WebLogic Java Process Spawning Shell or LOLBin on Windows
Detects a WebLogic server JVM spawning cmd, PowerShell or common download/execute binaries, a typical post-exploitation pattern after pre-auth deserialization RCE (T3/IIOP/HTTP). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WebLogic Java Process Spawning Shell or LOLBin on Windows
description: Detects a java.exe process running WebLogic spawning command interpreters
or download/execute utilities. This is the typical post-exploitation pattern after
unauthenticated deserialization RCE via T3, IIOP or HTTP against Oracle Fusion Middleware.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \java.exe
ParentCommandLine|contains:
- weblogic.Server
- weblogic.Name
- \wlserver
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
condition: selection_parent and selection_child
falsepositives:
- WebLogic administrators running custom maintenance scripts through the server JVM
- Application deployments that shell out to cmd.exe from WebLogic-hosted applications
level: high
id: 126b6bab-8306-51d0-b04f-2f9e855ffaae
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0448.html
Java Process Spawning Shell with Download or Reverse Shell Pattern on Linux
Detects a Java process (e.g. WebLogic, Helidon) spawning a shell that downloads payloads or opens a reverse shell, indicating exploitation of a deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Shell with Download or Reverse Shell Pattern on Linux
description: Detects a Java application server process such as WebLogic or Helidon
spawning sh or bash with command lines that download payloads, decode base64 or
open reverse shells. This pattern is expected after exploitation of pre-auth deserialization
flaws in Oracle Fusion Middleware.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
selection_child:
Image|endswith:
- /bash
- /sh
- /dash
selection_cmd:
CommandLine|contains:
- curl http
- wget http
- /dev/tcp/
- base64 -d
- base64 --decode
- nc -e
- chmod +x /tmp
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based build or deployment tooling that downloads artifacts with curl or wget
from a shell
- Application health-check scripts launched by the JVM
level: high
id: 72a5eede-8e2e-5eab-b59d-b489d9c1acfd
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0448.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0448.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,910 reports from 143 sources, 510 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs