Skip to content
Hermes Codex

CVE-2026-83021: Unauthenticated Remote Code Execution in Oracle WebLogic Server Web Container

HERMES

HERMES THREAT SCORE & ENTERPRISE WEBLOGIC PERIMETER COLLAPSE

Target: Oracle WebLogic Server — Core Web Container, Servlet Request Dispatcher & ClassLoader Subsystem
Confidence: 99%
100 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 20 / 20
Prevalence 20 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Both CVSS v3.1 and Hermes award CVE-2026-83021 the maximum threat rating of 10.0 / EXTREME 100. Oracle WebLogic Server powers thousands of enterprise mission-critical web applications. The vulnerability resides in the core Web Container request parsing pipeline. An unauthenticated attacker can exploit path normalization and servlet dispatch flaws over plain HTTP to achieve immediate remote code execution without user interaction, deploying persistent web shells and pivoting into corporate internal networks.

HASS

HASS AGENTIC SEVERITY & JAVA APPLICATION CONTAINER BREACH

Target: Enterprise Java EE Application Server, Servlet Container & Domain Cluster Network
Confidence: 97%
95 / 100
CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 17 / 20
Tool Access 20 / 20
Privilege 20 / 15
Persistence 19 / 15
External Impact 19 / 15
Propagation 19 / 15
⚖️ Divergence & Operational Rationale

Breaching the WebLogic Web Container grants attackers full authority to deploy rogue WAR web applications, inject malicious class bytecode into running JVM classloaders, and capture inbound HTTP transaction credentials across all enterprise applications hosted on the cluster.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-83021: Unauthenticated Remote Code Execution in Oracle WebLogic Server Web ContainerVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTOracle WebLogic Server
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Oracle WebLogic Server documented in Hermes dossier.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

Oracle WebLogic Server is an enterprise Java EE application server widely deployed across Fortune 500 enterprises, telecommunications providers, and financial institutions.

ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2026-83021Oracle CSPU September 2026 Advisory
Vulnerability ClassRemote Code Execution (CWE-287 / CWE-20 / CWE-94)Path traversal and unauthenticated servlet invocation
Affected ComponentWebLogic Web Container (weblogic.servlet)HTTP request processing pipeline on TCP 7001 / 7002
Protocol / PortHTTP / HTTPS (Default ports 7001, 7002, 80, 443)Exposed on external corporate web gateways and reverse proxies
Authentication RequiredNone (PR:N)Raw HTTP request without credentials or session cookies
User InteractionNone (UI:N)Automated execution upon receiving malicious request
Scope ImpactChanged (S:C)Extends to entire WebLogic domain cluster and database backends
Privileges ObtainedComplete Server TakeoverArbitrary code execution under the oracle/weblogic account
Affected Versions12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0Active WebLogic Server production releases
Remediation TargetSeptember 2026 Patch Set Update (PSU)Install PSU via OPatch and restrict management endpoints

2. Vulnerability Anatomy & Root Cause Analysis

Section titled “2. Vulnerability Anatomy & Root Cause Analysis”

URI Normalization & Servlet Dispatch Flaw

Section titled “URI Normalization & Servlet Dispatch Flaw”

The WebLogic Web Container is responsible for parsing HTTP request URIs, mapping them to registered servlet contexts, and applying security constraints (security-constraint elements in web.xml).

Prior to the September 2026 patch:

  1. A critical discrepancy existed between how the Web Container normalized URL paths containing specific matrix parameters, URL-encoded path traversal sequences (..%2f), and double-encoded semicolons (%253b).
  2. Security filters evaluating whether a request requires authentication inspected the un-normalized request URI, incorrectly determining that the request targeted a public or unprotected resource.
  3. However, when the internal servlet dispatcher routed the request to the target handler, it stripped the matrix parameters and resolved the normalized path, executing privileged internal deployment servlets (such as internal management, file-upload, or dynamic JSP compiler servlets) without requiring authentication.
  4. Attackers can leverage this bypass to write arbitrary .jsp web shells into application docroots or directly invoke internal deployment classes to execute operating system commands.
POST /console/images/%2e%2e%253b/bea_wls_internal/classes/AppDeployer HTTP/1.1
Host: wls.corp.internal:7001
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


action=deploy&path=/tmp/backdoor.war

The server processes the request with administrative privileges, deploying the backdoor application and returning an active web shell URL to the attacker.

3. Attack Vector & Weaponization Mechanics

Section titled “3. Attack Vector & Weaponization Mechanics”
sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker (Unauthenticated)
    participant WLS as WebLogic Front-End (Port 7001)
    participant Container as Web Container (URI Normalization)
    participant Dispatcher as Internal Servlet Dispatcher
    participant FS as Host Filesystem (tmp/_WL_user/)


    Attacker->>WLS: Send crafted HTTP POST with path traversal bypass (CVE-2026-83021)
    WLS->>Container: Evaluate security constraints against un-normalized URI
    Container->>Container: Bypasses authentication filter (treats as public image path)
    Container->>Dispatcher: Route normalized request to internal deployment servlet
    Dispatcher->>FS: Drop malicious JSP web shell into docroot (/tmp/_WL_user/...)
    FS-->>Attacker: Return HTTP 200 OK (Web shell path confirmed)
    Attacker->>FS: Request web shell (/bea_wls_internal/shell.jsp?cmd=whoami)
    FS-->>Attacker: Execute arbitrary commands under 'oracle' user context

4. Detection Engineering & Threat Hunting

Section titled “4. Detection Engineering & Threat Hunting”
title: WebLogic Web Container Path Traversal RCE Attempt
id: cve-2026-83021-wls-rce
status: production
description: Detects path traversal and matrix parameter bypass patterns targeting WebLogic internal servlets.
references:
  - https://www.oracle.com/security-alerts/cspusep2026.html
author: Hermes Codex DFIR Team
date: 2026-09-17
modified: 2026-09-22
logsource:
  category: webserver
  product: oracle_weblogic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - 'bea_wls_internal'
      - 'console'
    cs-uri-stem|re: '(%2e%2e|%253b|\.\.;|/\.\./)'
  condition: selection
falsepositives:
  - None expected for this specific traversal signature
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003

5. Forensic Investigation & Incident Response Playbook

Section titled “5. Forensic Investigation & Incident Response Playbook”

When investigating suspected exploitation of CVE-2026-83021:

  1. WebLogic HTTP Access Log Triage: Examine access logs under $DOMAIN_HOME/servers/<server_name>/logs/access.log:
    Terminal window
    grep -E "(%2e|%3b|\.\.;|bea_wls_internal)" $DOMAIN_HOME/servers/*/logs/access.log
    Identify the originating IP address and all subsequent requests to dropped .jsp files.
  2. Filesystem Triage for Dropped Web Shells: Scan WebLogic temporary deployment and extraction folders:
    Terminal window
    find $DOMAIN_HOME/servers/*/tmp/_WL_user/ -name "*.jsp" -mtime -14 -ls
    find $DOMAIN_HOME/servers/*/stage/ -name "*.war" -mtime -14 -ls
  3. Process Lineage Analysis: Look for interactive shells and anomalous child processes spawned by WebLogic:
    Terminal window
    pstree -p $(pgrep -f "weblogic.Server")
    ps -ef | grep java | grep -E "(bash|sh|cmd|powershell|curl|wget|nc)"

6. Remediation, Patching & Hardening

Section titled “6. Remediation, Patching & Hardening”

  1. T0 Immediate Action (< 24h) — Apply Oracle September 2026 Patch Set Update (PSU): Install the official WebLogic PSU via OPatch:

    Terminal window
    cd $ORACLE_HOME/WLS_PATCH_SEP2026
    opatch apply

    Restart all WebLogic AdminServers, ManagedServers, and NodeManagers.

  2. T0 Mitigation — Restrict Perimeter Exposure & Administrative Endpoints: If patching cannot be executed immediately:

    • Block external traffic to default management ports 7001 and 7002 at edge firewalls.
    • Configure reverse proxies (NGINX, F5 BIG-IP, Apache HTTP Server) to reject HTTP matrix parameters (semicolons in URI path) and URL-encoded dots: 
      if ($request_uri ~* "(\;|\%3b|\%2e\%2e|\.\.)") {
          return 403;
      }

  3. T1 Tactical Hardening (< 7d) — Disable Internal Servlets & Tunneling: Disable HTTP tunneling and remove unnecessary internal applications:

    • In the WebLogic Administration Console, navigate to Environment > Servers > [Server Name] > Protocols > General and verify Enable Tunneling is unchecked.
    • Restrict egress internet access from WebLogic application hosts.

7. Related Intelligence & Attack Paths

Section titled “7. Related Intelligence & Attack Paths”
Oracle WebLogic Server Intelligence Track patch release history, vulnerability landscape, and mitigation posture for WebLogic.
Hermes Decision Engine Evaluate operational remediation directives and calculate residual risk deltas for enterprise assets.
Private Stack Audit Audit your software inventory against CVE-2026-83021 privately in your browser.