Oracle's October 2026 Critical Patch Update contains six vulnerabilities scored 10.0 and several more at 9.8 in WebLogic Server Core: CVE-2026-83399 reachable over T3 and IIOP, and CVE-2026-91323 reachable over HTTP. Both allow an unauthenticated network attacker to take over the server, and both affect WebLogic 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.
The exposure question that follows is how much WebLogic is reachable, and the more useful version of that question is how much T3 is reachable. ZoomEye could not be queried for this article because the API returned HTTP 502 throughout the research window, so no counts are reported. The measurement design and its pitfalls are.
Why WebLogic is hard to count
app="WebLogic" and title="Error 404--Not Found" are the two queries practitioners reach for, and both have well-known failure modes.
The fingerprint query finds assets ZoomEye recognises as WebLogic. WebLogic's default error pages and console paths are distinctive, which helps. But WebLogic is frequently shielded behind a reverse proxy that rewrites error pages, and the console is frequently restricted to internal networks, which removes the most identifiable surface without removing the server.
The error-page query is broader than it looks. Error 404--Not Found is a specific WebLogic string that also appears on other systems that copied it, and it appears on WebLogic deployments that serve no application at all. A count from that query describes a page signature, not a running application server in production.
Neither query sees T3. T3 is a binary protocol on a port, and ZoomEye can report that a port answered without necessarily identifying the protocol in a way that maps cleanly to "T3 is exposed".
The port evidence that matters
port=7001
port=7001 && app="WebLogic"
port=7002 && app="WebLogic"
port=7001 || port=7002
Port 7001 is the default for the administrative and managed server listeners; 7002 is the conventional SSL listener. A bare port query returns everything on the number, which on the public internet is a mixture of WebLogic, unrelated services, and scanner infrastructure.
The combined query is stricter and produces a smaller, more defensible set. It also has a structural blind spot: an organisation that moved its listeners to non-default ports to reduce automated scanning will not appear, and that organisation may well have the more mature programme.
T3 exposure specifically is best inferred from certificates and from application behaviour rather than from port presence. A WebLogic domain reachable on 7001 with T3 open is the condition that makes CVE-2026-83399 exploitable over the network. A domain behind an HTTP-only reverse proxy on the same port is not, at least not through that path.
What the measurement is genuinely for
Three uses, in descending order of value.
First, finding unknown assets. Any WebLogic listener visible from the internet that the internal inventory does not list is a finding, and the finding is the absence from inventory rather than the port.
Second, comparing roles. A WebLogic instance terminating a public application and a WebLogic instance serving an internal integration are different propositions. Certificate subjects, hosting organisation and geography separate them usefully.
Third, tracking change over time. A WebLogic estate that grows on the internet between two quarters is a governance question, because WebLogic deployments are rarely created casually.
What the measurement cannot do is tell you whether T3 is exposed on any particular asset. That requires a targeted connection attempt against an address you own, or a review of listener configuration.
Queries worth keeping
A management-plane view that is more useful than a WebLogic-only count:
app="WebLogic" && port=7001
title="Oracle WebLogic" || title="Error 404--Not Found"
ssl="weblogic"
The certificate query is worth its own line because organisations commonly issue certificates with weblogic in the subject common name, which documents the role without documenting the build.
The paragraph that belongs in every WebLogic report
Exposure counts for application servers describe reachability, not vulnerability. A WebLogic server on 12.2.1.3.0 is affected by the T3-reachable entries in this CPU regardless of whether it appears in any scan, because it sits inside a network. A WebLogic server on a fixed version that is nonetheless reachable with T3 open from an untrusted network is a policy failure waiting to become an incident after the next T3 CVE.
Neither condition is visible in ZoomEye output, and both are more consequential than the count.
References
Oracle Critical Patch Update Advisory, October 2026
NVD entries for CVE-2026-83399 and CVE-2026-91323, including affected versions and the T3/IIOP and HTTP vectors
ZoomEye official MCP search syntax reference for
app,port,title,sslandcountry