This vulnerability in Oracle WebLogic Server's Web Services component allows an unauthenticated attacker to remotely access sensitive data via HTTP without requiring privileges or user interaction. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact. Oracle's April 2026 Critical Patch Update includes fixes for this vulnerability as part of a large set of security patches for Fusion Middleware products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle WebLogic Server, impacting confidentiality. There is no impact on integrity or availability according to the CVSS vector. This could compromise sensitive information hosted or processed by the affected server versions.

Oracle has released patches for this vulnerability in the April 2026 Critical Patch Update for Fusion Middleware products. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly advises remaining on actively supported versions and applying Critical Patch Updates without delay. No additional mitigation steps are indicated by the vendor advisory beyond patching.