DBPros.Net
advisory@dbpros.netIntake Portal
CVE-2026-21945WebLogic Deserialization RCET3 Protocol Vulnerability

Oracle WebLogic July 2026 Critical Patch Update (CPU): Unauthenticated Deserialization & PeopleSoft/Banner Web Tier Hardening

Technical guide to July 2026 WebLogic Server vulnerabilities impacting PeopleSoft Internet Architecture (PIA) and Ellucian Banner web applications, with patching instructions.

⚡ BLUF (Bottom Line Up Front) Summary

The July 2026 Oracle Critical Patch Update addresses critical unauthenticated Remote Code Execution (RCE) deserialization vulnerabilities (CVSS 9.8) in Oracle WebLogic Server 12.2.1.4 and 14.1.1.0. Systems administrators managing PeopleSoft Internet Architecture (PIA) or Ellucian Banner web tiers must apply WebLogic Patch Set Updates (PSU) and disable T3/IIOP protocols on public ports immediately.

Environment & Prerequisites

ComponentVersion / Specification
Web Tier ServerOracle WebLogic Server (12.2.1.4, 14.1.1.0)
ERP Web ApplicationsPeopleSoft Internet Architecture (PIA), Ellucian Banner 9.x
ProtocolsT3, T3S, IIOP, HTTP 2.0

Executive Summary: WebLogic & ERP Web Tier Risk (July 2026 CPU)

Oracle’s July 2026 Critical Patch Update (CPU) contains severe security patches for Oracle WebLogic Server (12.2.1.4 and 14.1.1.0), the application server powering PeopleSoft Internet Architecture (PIA) and Ellucian Banner 9.x web tiers.

The most dangerous flaw disclosed is an unauthenticated HTTP/T3 deserialization remote code execution (RCE) vulnerability allowing external attackers to hijack WebLogic domain processes without credentials.

Key WebLogic Vulnerabilities Disclosed

1. Unauthenticated WebLogic T3/HTTP Deserialization RCE (CVSS 9.8)

  • The Threat: An unauthenticated attacker transmitting serialized Java objects over T3 or HTTP protocols can execute arbitrary OS commands as the oracle/weblogic OS user.
  • Impact on PeopleSoft & Banner: Exposes PeopleSoft PIA Web Servers (PORT 8000/8443) and Banner Admin Pages to complete server compromise.

2. HTTP/2 Request Smuggling in WebLogic Proxy Plug-ins (CVSS 8.2)

  • The Threat: Crafting malformed HTTP/2 headers allows request smuggling past Nginx / F5 load balancers directly into backend WebLogic managed servers.

🔍 Check Your WebLogic Environment Now (Diagnostic CTA)

Run the following command on your WebLogic host right now to verify your current WebLogic PSU (Patch Set Update) patch level:

# Diagnostic 1: Check Applied WebLogic PSU via BSAPatch / OPatch
$MW_HOME/OPatch/opatch lsinventory | grep -E "WebLogic Server|Patch"
# Diagnostic 2: Check if Dangerous T3/IIOP Ports Are Exposed to the Internet
nmap -p 7001,8000,8443 localhost

Action Criteria:

  • WebLogic 12.2.1.4: Must reflect WebLogic Server 12.2.1.4.260721 PSU or higher.
  • 🚨 If T3/IIOP protocols are enabled on internet-facing IP addresses, your PeopleSoft or Banner web tier is vulnerable to automated RCE exploits.

Recommended WebLogic Hardening & Patching Steps

Step 1: Apply July 2026 WebLogic PSU Patch

# Stop WebLogic Managed Servers & Admin Server
$DOMAIN_HOME/bin/stopWebLogic.sh

# Apply July 2026 PSU via OPatch
$MW_HOME/OPatch/opatch apply /u01/patches/WebLogic_Jul2026_PSU

Step 2: Disable T3 & IIOP Protocols in WebLogic Console

If your WebLogic domain only serves web HTTP/HTTPS traffic for PeopleSoft PIA or Banner:

  1. Log into WebLogic Admin Console (http://admin-host:7001/console).
  2. Navigate to Environment -> Servers -> [Server Name] -> Protocols.
  3. Uncheck Enable IIOP.
  4. Create a Connection Filter to block external T3 traffic:
# WebLogic Connection Filter Rules (etc/security.properties)
weblogic.security.net.ConnectionFilterImpl
0.0.0.0/0 * 7001 deny t3 t3s

Need assistance hardening or patching PeopleSoft PIA or Banner WebLogic domains? Download our Nginx & WebLogic Hardening Runbook or Schedule an Async Web Tier Audit.