Oracle WebLogic July 2026 Critical Patch Update (CPU): Unauthenticated Deserialization & PeopleSoft/Banner Web Tier Hardening

Executive Summary: WebLogic & ERP Web Tier Risk (July 2026 CPU)

racle’s July 2026 Critical Patch Update (CPU) contains severe security patches for Oracle WebLogic Server (12.2.1.4 and 14.1.1.0), the application server powering PeopleSoft Internet Architecture (PIA) and Ellucian Banner 9.x web tiers.

The most dangerous flaw disclosed is an unauthenticated HTTP/T3 deserialization remote code execution (RCE) vulnerability allowing external attackers to hijack WebLogic domain processes without credentials.

---

Key WebLogic Vulnerabilities Disclosed

1. Unauthenticated WebLogic T3/HTTP Deserialization RCE (CVSS 9.8)

• The Threat: An unauthenticated attacker transmitting serialized Java objects over T3 or HTTP protocols can execute arbitrary OS commands as the oracle/weblogic OS user.
• Impact on PeopleSoft & Banner: Exposes PeopleSoft PIA Web Servers (PORT 8000/8443) and Banner Admin Pages to complete server compromise.

2. HTTP/2 Request Smuggling in WebLogic Proxy Plug-ins (CVSS 8.2)

• The Threat: Crafting malformed HTTP/2 headers allows request smuggling past Nginx / F5 load balancers directly into backend WebLogic managed servers.

---

🔍 Check Your WebLogic Environment Now (Diagnostic CTA)

Run the following command on your WebLogic host right now to verify your current WebLogic PSU (Patch Set Update) patch level:

# Diagnostic 1: Check Applied WebLogic PSU via BSAPatch / OPatch
$MW_HOME/OPatch/opatch lsinventory | grep -E "WebLogic Server|Patch"

# Diagnostic 2: Check if Dangerous T3/IIOP Ports Are Exposed to the Internet
nmap -p 7001,8000,8443 localhost

Action Criteria:

• WebLogic 12.2.1.4: Must reflect WebLogic Server 12.2.1.4.260721 PSU or higher.
• 🚨 If T3/IIOP protocols are enabled on internet-facing IP addresses, your PeopleSoft or Banner web tier is vulnerable to automated RCE exploits.

---

Recommended WebLogic Hardening & Patching Steps

Step 1: Apply July 2026 WebLogic PSU Patch

# Stop WebLogic Managed Servers & Admin Server
$DOMAIN_HOME/bin/stopWebLogic.sh

# Apply July 2026 PSU via OPatch
$MW_HOME/OPatch/opatch apply /u01/patches/WebLogic_Jul2026_PSU

Step 2: Disable T3 & IIOP Protocols in WebLogic Console

If your WebLogic domain only serves web HTTP/HTTPS traffic for PeopleSoft PIA or Banner:

1. Log into WebLogic Admin Console (http://admin-host:7001/console).
2. Navigate to Environment -> Servers -> [Server Name] -> Protocols.
3. Uncheck Enable IIOP.
4. Create a Connection Filter to block external T3 traffic:

# WebLogic Connection Filter Rules (First-Match-Wins Evaluation)
# Format: target local_port action protocols
192.168.10.0/24 * 7001 allow t3 t3s
10.50.0.0/16 * 7001 allow t3 t3s
0.0.0.0/0 * 7001 deny t3 t3s

---

📚 Official Documentation & Technical References

• MOS Doc ID 2806740.1: Critical Patch Update (CPU) Patch Availability Document for Oracle WebLogic Server — My Oracle Support tracking note for WebLogic Patch Set Updates (PSU) and overlay patches.

• Oracle Security Alerts & Critical Patch Updates — Official Oracle security advisory portal for quarterly CPU announcements and CVSS vulnerability scoring.

• Oracle WebLogic Server Documentation — Official documentation for WebLogic Server 12.2.1.4 and 14.1.1.0 domain administration, security hardening, and T3 protocol tuning.

• ORACLE-BASE: WebLogic Server 12c and 14c Security Hardening — Tim Hall’s step-by-step guide to securing WebLogic ports, disabling unneeded protocols, and enforcing network access rules.

---

Need assistance hardening or patching PeopleSoft PIA or Banner WebLogic domains? Download our Nginx & WebLogic Hardening Runbook or Schedule an Async Web Tier Audit.