Oracle WebLogic Server

Tenable plugin 166313 fires when Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0 or 14.1.1.0.0 is missing the October 2022 Critical Patch Update. The bundle remediates a stack of issues including CVE-2022-21616 (Core component, network-reachable, low complexity), CVE-2022-22971 (Spring Framework DoS via specially-crafted requests), CVE-2020-28052 (Bouncy Castle BKS-V1 keystore bypass — affects TLS trust), CVE-2020-17521 (Apache Groovy temp-file disclosure), CVE-2021-29425 (Apache Commons IO path traversal), and CVE-2023-23437 (Xerces-J infinite loop). Tenable rates the plugin HIGH (8.1 CVSS v3) — the MEDIUM tag in your queue is from a downstream aggregation, not Oracle's own scoring.

Vendor severity here is *understated*. WebLogic is a canonical enterprise middleware target with a long, ugly history in CISA's KEV catalog (CVE-2017-10271, CVE-2019-2725, CVE-2020-2883, CVE-2020-14882, CVE-2023-21839 — all WebLogic). Mass scanning for WebLogic T3/IIOP and /console is continuous on GreyNoise. A host still at the pre-Oct-2022 patch level in 2026 has also missed every subsequent quarterly CPU, meaning the actual exposed CVE set is much larger than what 166313 alone signals.

Why this verdict

• Role multiplier — WebLogic is high-value middleware by definition: it hosts the line-of-business app tier (ERP, financial systems, identity gateways). Chain ends in app-layer takeover plus access to backend DB creds and JNDI secrets — fleet-scale blast radius once leveraged.
• Stale-patch tax: a host failing 166313 in 2026 has missed ~15 subsequent CPUs (Jan 2023 → Apr 2026), including KEV-listed CVE-2023-21839 and CVE-2024-21006/21181. The plugin is a proxy for *systemic* patch-program failure on that host.
• Continuous scanner pressure: GreyNoise and Shodan show daily mass-scanning for WebLogic admin endpoints. Friction is not 'no one looks' — friction is 'is the console externally reachable.'
• Friction adjustment downward: CVE-2022-21616 has AC:H, and several bundled CVEs (Groovy, Commons IO) need authenticated or app-specific reach. That is what keeps the score at 7.8 instead of 9.x — but it does not pull below HIGH given role.

Why not higher?

Bundle does *not* contain an unauthenticated, low-complexity, wormable RCE on par with CVE-2020-14882 or CVE-2023-21839. The headline CVE (2022-21616) is AC:H, and the Bouncy Castle / Groovy / Commons IO components require specific runtime conditions. Absent confirmation that *this specific host* exposes T3 to the internet, CRITICAL would overstate it.

Why not lower?

MEDIUM ignores WebLogic's role as the application-tier identity-and-data fan-out point and its persistent KEV history. A host missing the Oct 2022 CPU is missing every CPU after it as well — treating this as backlog hygiene gives attackers a free runway. The combination of installed-base sensitivity and continuous scanner targeting floors this at HIGH.

1. Block T3/T3s (7001/7002) at the perimeter and segment internally — Use the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3/T3s except from a known admin allowlist, and confirm perimeter firewalls drop 7001/7002. T3 is the historic vector for almost every WebLogic worm. Deploy within the noisgate mitigation SLA of 30 days.
2. Remove /console and /em from external exposure — Use the front-end reverse proxy (NGINX/Apache/F5) to deny /console, /em, /wls-wsat, /wls_utc. These paths gate authentication- and Spring-based vectors. Same 30-day window.
3. Deploy WAF virtual patches for known WebLogic payload patterns — Enable F5 ASM, Akamai, or ModSecurity OWASP CRS rules for Java deserialization markers (rO0AB), wls-wsat POSTs, and Spring binder anomalies. Bridges the gap until the CPU lands.
4. Jump straight to the latest CPU, not just Oct 2022 — Catching up patch-by-patch is wasted change-window. Test against the current quarter (Apr 2026 CPU) and roll one big upgrade. Remediation must land within the noisgate remediation SLA of 180 days.
5. Audit WebLogic service-account scope — Constrain the OS user running WebLogic to a non-root account with no write access outside domains/. Limits webshell drop and reduces lateral movement when (not if) the next WebLogic 0-day lands.

Run this on the WebLogic application host as the user that owns the WebLogic install (often oracle or weblogic). Invoke with ./check_wls_oct2022.sh /u01/app/oracle/middleware where the argument is $MW_HOME. Read-only; no privileges beyond access to the install directory.

#!/usr/bin/env bash
# noisgate verification — Oracle WebLogic Oct 2022 CPU (Tenable 166313)
# Exit 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
MW_HOME="${1:-}"
if [[ -z "$MW_HOME" || ! -d "$MW_HOME" ]]; then
  echo "usage: $0 <MW_HOME>"; echo "UNKNOWN"; exit 2
fi

# 1. Identify base WLS version
REG="$MW_HOME/inventory/registry.xml"
if [[ ! -f "$REG" ]]; then
  # fallback: parse from product.properties
  PROP=$(find "$MW_HOME" -name product.properties -path '*wlserver*' 2>/dev/null | head -n1)
  [[ -z "$PROP" ]] && { echo "UNKNOWN: no registry.xml or product.properties"; exit 2; }
  WLS_VER=$(awk -F= '/^WLS_PRODUCT_VERSION/ {print $2}' "$PROP" | tr -d '\r')
else
  WLS_VER=$(grep -oE 'WebLogic Server" version="[0-9.]+' "$REG" | head -n1 | awk -F'"' '{print $4}')
fi
echo "WLS base version: ${WLS_VER:-unknown}"

if [[ -z "$WLS_VER" ]]; then echo "UNKNOWN"; exit 2; fi

# 2. Plugin scope: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
case "$WLS_VER" in
  12.2.1.3.0|12.2.1.4.0|14.1.1.0.0) ;;
  *) echo "PATCHED (version $WLS_VER outside 166313 scope)"; exit 0 ;;
esac

# 3. Check for Oct 2022 PSU and later via OPatch
OPATCH="$MW_HOME/OPatch/opatch"
[[ ! -x "$OPATCH" ]] && OPATCH=$(find "$MW_HOME" -name opatch -type f 2>/dev/null | head -n1)
if [[ -z "$OPATCH" || ! -x "$OPATCH" ]]; then
  echo "UNKNOWN: opatch not found"; exit 2
fi

ORACLE_HOME="$MW_HOME" "$OPATCH" lsinventory -oh "$MW_HOME" 2>/dev/null > /tmp/wls_inv.$$
if ! [[ -s /tmp/wls_inv.$$ ]]; then
  echo "UNKNOWN: opatch lsinventory empty"; rm -f /tmp/wls_inv.$$; exit 2
fi

# Oct 2022 PSU patch IDs per Oracle Doc 2806740.2
# 12.2.1.3.0 -> 34604561 ; 12.2.1.4.0 -> 34601861 ; 14.1.1.0.0 -> 34601734
declare -A PSU=(
  [12.2.1.3.0]=34604561
  [12.2.1.4.0]=34601861
  [14.1.1.0.0]=34601734
)
REQ=${PSU[$WLS_VER]}
if grep -qE "Patch[[:space:]]+($REQ|[0-9]{8})" /tmp/wls_inv.$$ && grep -qE "WLS PATCH SET UPDATE (12|14)\.[0-9.]+" /tmp/wls_inv.$$; then
  # any installed PSU >= Oct 2022? look for date strings 2022-10 or later
  if grep -qE '2022-1[0-2]|202[3-9]-[0-9]{2}' /tmp/wls_inv.$$; then
    echo "PATCHED (PSU at or after Oct 2022 detected)"; rm -f /tmp/wls_inv.$$; exit 0
  fi
fi

echo "VULNERABLE: $WLS_VER without Oct 2022 PSU (expected patch $REQ or newer)"
rm -f /tmp/wls_inv.$$
exit 1

Sources

1. Tenable Plugin 166313 — Oracle WebLogic Server (Oct 2022 CPU)
2. Oracle Critical Patch Update Advisory — October 2022
3. CISA Alert — Oracle Releases October 2022 Critical Patch Update
4. CISA KEV Catalog (WebLogic historical entries)
5. CVE-2020-28052 — Bouncy Castle BKS-V1 HMAC bypass
6. CVE-2022-22971 — Spring Framework DoS
7. Rapid7 vulndb — WebLogic Oct 2022 CPU coverage
8. FIRST EPSS dataset