CVE-2022-21371: Oracle WebLogic Server path traversal exposes local files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable file disclosure with a very high EPSS score and a public exploit reference, though not in KEV.

What it is

Oracle WebLogic Server's Web Container component is affected by a path traversal (CWE-22) flaw in versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can read files accessible to the WebLogic process, which may expose configuration, credentials or other critical data.

Impact

An attacker gains unauthorized read access to critical data or complete access to all data reachable by the WebLogic Server process. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any WebLogic HTTP listener on an affected version is in scope.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.92649, 99.8th percentile) and a public exploit reference exists (Packet Storm local file inclusion). No ransomware association is documented.

What to do

• Apply the Oracle January 2022 Critical Patch Update for WebLogic Server; upgrade to a fixed release for your affected version line.
• If patching cannot be immediate, restrict network access to WebLogic HTTP ports to trusted hosts only.
• Run WebLogic under a least-privilege OS account so file reads are limited to non-sensitive paths.
• Remove or rotate any credentials or secrets stored in files readable by the WebLogic process.
• Monitor vendor advisories for updated guidance on affected versions.

Detection

• Inspect WebLogic HTTP access logs for requests containing path traversal sequences (../, ..%2f, encoded variants) targeting file paths.
• Alert on HTTP requests to WebLogic endpoints returning unusually large or file-like responses.
• Monitor for reads of sensitive files (e.g., configuration, keystore, property files) by the WebLogic process user.
• Correlate WebLogic access log entries with process-level file access telemetry on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.