This vulnerability affects Oracle WebLogic Server Core component in versions 12.2.1.4.0 and 14.1.1.0.0. It is exploitable remotely without authentication via network protocols T3 and IIOP. The flaw allows attackers to gain unauthorized access to critical or all data accessible by the WebLogic Server, impacting confidentiality but not integrity or availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact. Oracle has acknowledged this vulnerability in their July 2024 Critical Patch Update and provides patches for affected versions. No known exploits in the wild have been reported as of the publication date.

Exploitation of this vulnerability can result in unauthorized disclosure of critical or all data accessible by the Oracle WebLogic Server. There is no impact on integrity or availability according to the CVSS vector. Because the attack requires no authentication and can be performed remotely over network protocols T3 and IIOP, the risk to confidentiality is significant. This could lead to exposure of sensitive information hosted or processed by the affected WebLogic Server instances.

Oracle has released patches for this vulnerability as part of the July 2024 Critical Patch Update. Customers using affected versions 12.2.1.4.0 and 14.1.1.0.0 of Oracle WebLogic Server should apply the relevant security patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying Critical Patch Updates to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified in the advisory.