Changeflow GovPing Data Privacy & Cybersecurity Multiples vulnérabilités dans Oracle Weblogic S...
Urgent Guidance Added Final

Multiples vulnérabilités dans Oracle Weblogic Server

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published advisory CERTFR-2026-AVI-0473 on 22 April 2026 alerting organisations to multiple critical vulnerabilities in Oracle WebLogic Server affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerabilities enable remote code execution, remote denial of service, data confidentiality compromise, and integrity breaches. Eight CVEs are referenced including CVE-2025-35036, CVE-2025-46392, and CVE-2026-34305. Affected parties are directed to apply Oracle's Critical Patch Update released 21 April 2026.

“De multiples vulnérabilités ont été découvertes dans Oracle Weblogic. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.”

— ANSSI , verbatim from source
Why this matters

Any organisation running Oracle WebLogic Server 12.2.1.4.0 through 15.1.1.0.0 should immediately inventory their installations and apply Oracle's Critical Patch Update released 21 April 2026. These vulnerabilities are remotely exploitable without authentication and the RCE risk is severe — affected deployments, particularly internet-facing middleware, should be treated as a priority patching cycle. While this is a CERT-FR advisory, the underlying Oracle CPU is global and may also trigger obligations under EU NIS2 incident reporting timelines if exploitation occurs.

AI-drafted from the source document, validated against GovPing's analyst note standards . For the primary regulatory language, read the source document .
Published by ANSSI on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .

About this source

GovPing monitors CERT-FR Security Advisories for new data privacy & cybersecurity regulatory changes. Every update since tracking began is archived, classified, and available as free RSS or email alerts — 183 changes logged to date.

View original document View source feed page

What changed

CERT-FR issued a critical security advisory covering eight vulnerabilities in Oracle WebLogic Server across four versions. The most severe allow unauthenticated remote attackers to execute arbitrary code, cause denial of service, or exfiltrate data over the network without user interaction. The advisory cites Oracle's April 2026 Critical Patch Update as the authoritative patch source and lists eight associated CVEs.

Organisations running Oracle WebLogic Server should immediately inventory their installations against the affected versions and apply Oracle's April 2026 CPU as a priority. The vulnerabilities are remotely exploitable and carry significant risk for any internet-facing middleware deployments. Security teams should treat this as an urgent patching cycle, not a routine update.

What to do next

  1. Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation)

Archived snapshot

Apr 22, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 22 avril 2026 N° CERTFR-2026-AVI-0473 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Oracle Weblogic

Gestion du document

| Référence | CERTFR-2026-AVI-0473 |
| Titre | Multiples vulnérabilités dans Oracle Weblogic |
| Date de la première version | 22 avril 2026 |
| Date de la dernière version | 22 avril 2026 |
| Source(s) | Bulletin de sécurité Oracle Weblogic cpuapr2026 du 21 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à l'intégrité des données
  • Atteinte à la confidentialité des données
  • Contournement de la politique de sécurité
  • Déni de service à distance
  • Exécution de code arbitraire à distance

Systèmes affectés

  • Oracle WebLogic Server version 12.2.1.4.0
  • Oracle WebLogic Server version 14.1.1.0.0
  • Oracle WebLogic Server version 14.1.2.0.0
  • Oracle WebLogic Server version 15.1.1.0.0

Résumé

De multiples vulnérabilités ont été découvertes dans Oracle Weblogic. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 22 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans GitLab versions 18.9.6 à 18.11.1
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans les produits Microsoft
Priority review Apr 21, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Microsoft .NET Vulnerability Enables Privilege Escalation (CVE-2026-40372)
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from ANSSI.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
ANSSI
Published
April 22nd, 2026
Instrument
Guidance
Branch
Executive
Source language
fr
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0473

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability patching Server patch management Remote code execution mitigation
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology Consumer Finance

Browse Categories

Agriculture & Food Safety 74 AI Regulation 3 Banking & Finance 426 Consumer Protection 90 Courts & Legal 417 Data Privacy & Cybersecurity 90 Defense & National Security 53 Education 60 Energy 101 Environment 160 Gaming 2 Government & Legislation 439 Healthcare 15 Healthcare & Life Sciences 387 Immigration 10 Insurance 80 Labor & Employment 146 Pharma & Drug Safety 21 Professional Licensing 8 Real Estate & Housing 82 Securities & Markets 158 Tax 82 Telecom & Technology 48 Trade & Sanctions 141 Transportation 91

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!