CVE-2007-0416: Bea WebLogic Server

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.

Affected products

• Bea WebLogic Server: version 9.0 only; version 9.1 only

Published 2007-01-23. Last modified 2026-06-16.