WebLogic on the internet: the T3 problem that a port count will not solve

Oracle's October 2026 Critical Patch Update for WebLogic Server identifies six vulnerabilities rated 10.0 and several others at 9.8, affecting several versions. Two of these vulnerabilities, CVE-2026-83399 and CVE-2026-91323, can be exploited remotely over T3 and IIOP, and HTTP respectively, allowing an unauthenticated attacker to take control of the server.

The key question is how much of WebLogic is reachable, but the more relevant question is how accessible the T3 protocol is. ZoomEye, a tool used for such assessments, could not provide specific counts due to technical issues. However, common methods to detect WebLogic servers on the internet include fingerprint queries that look for distinctive error pages and console paths, but these methods have limitations.

For instance, WebLogic servers behind reverse proxies or restricted to internal networks are often missed. Additionally, T3, a binary protocol, cannot be easily identified by ZoomEye. Instead, the presence of T3 is better inferred from certificates and application behavior. The measurement of WebLogic servers on the internet serves three purposes: finding unknown assets, comparing different roles, and tracking changes over time.

The most valuable use is identifying undisclosed WebLogic servers, as this can reveal gaps in an organization's inventory. Other uses, such as comparing roles or tracking changes, are also beneficial but less direct. Importantly, the measurement cannot determine if T3 is exposed on a specific asset, which requires a targeted connection attempt or review of listener configuration.

While various queries can provide insights, they often fall short of giving a complete picture. For example, an application server count based on WebLogic alone is less useful than one that also considers the port. Similarly, certificate queries can provide valuable context, as organizations often use "weblogic" in certificate subject common names to indicate the server's role.

Ultimately, exposure counts for application servers indicate reachability, not vulnerability. A WebLogic server on an outdated version is affected by vulnerabilities even if it is not detected by any scans. Similarly, a server on a fixed version that is reachable over T3 from an untrusted network represents a policy failure that could lead to incidents in the future. This distinction between reachability and vulnerability is crucial for effective risk management.