This vulnerability (CVE-2026-35258) affects Oracle WebLogic Server Console in versions 14.1.2.0.0 and 15.1.1.0.0. It is exploitable by a low privileged attacker with network access over HTTPS and requires user interaction from a person other than the attacker. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data and full access to all WebLogic Server accessible data, impacting confidentiality and integrity. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N with a base score of 8.7. Oracle’s June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level. Oracle advises customers to apply security patches promptly and consider network protocol blocking or privilege restrictions as temporary mitigations.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and complete unauthorized access to all data accessible by WebLogic Server. The vulnerability impacts confidentiality and integrity but does not affect availability. It requires network access via HTTPS and user interaction from a third party. The scope of impact may extend beyond WebLogic Server to additional products due to the nature of the vulnerability.

Oracle strongly recommends applying Critical Security Patch Update security patches as soon as they become available. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges or package access from users who do not need them. These mitigations may impact application functionality. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, check Oracle’s official advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.