Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Oracle WebLogic Server allows remote access via messaging

CVE-2016-0638 · published 10 years ago
Summary

The WebLogic Server component in Oracle Fusion Middleware versions 10.3.6, 12.1.2, 12.1.3, and 12.2.1 can be reached from the internet through its Java Messaging Service feature. Attackers could view, modify, or disrupt the information that passes through this service. Apply the latest security updates from Oracle as soon as possible to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle weblogic_server 10.3.6.0.0
12.1.2.0.0
12.1.3.0.0
12.2.1.0.0
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and av...
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
63% chance of attack within 30 days
Timeline
Published21 Apr 2016
Updated30 Sep 2026
First seen29 Sep 2026
Sources
CVE-2016-0638 · NVD
Track software like this
Free during beta