This vulnerability affects Oracle WebLogic Server's Web Services component in multiple supported versions. It is easily exploitable by unauthenticated attackers over HTTP, allowing unauthorized access to sensitive data. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a high confidentiality impact. The vulnerability is tracked as CWE-200 (Information Exposure). Oracle's April 2026 Critical Patch Update advisory includes patches addressing this vulnerability among 481 security fixes across various products. Customers should review the advisory and apply the relevant patches promptly.

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle WebLogic Server. The vulnerability impacts confidentiality but does not affect integrity or availability. No known exploits are reported in the wild, but the vulnerability is considered easily exploitable due to lack of authentication and network accessibility.

Oracle strongly recommends applying the April 2026 Critical Patch Update for Fusion Middleware products, which includes patches for this vulnerability. Customers should ensure they are running actively supported versions and apply the update without delay. Patch status is implied to be available via the Critical Patch Update, but users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for detailed patch availability and installation instructions.