CVE-2026-35258 is a vulnerability in the Console component of Oracle WebLogic Server (versions 14.1.2.0.0 and 15.1.1.0.0) that allows a low privileged attacker with network access over HTTPS to compromise the server. Exploitation requires user interaction from someone other than the attacker and can result in unauthorized creation, deletion, or modification of critical data, as well as complete access to all data accessible by WebLogic Server. The vulnerability affects confidentiality and integrity but not availability, with a CVSS 3.1 score of 8.7. Oracle has included a fix for this vulnerability in its June 2026 Critical Security Patch Update. The vendor strongly recommends applying the patch immediately and notes that mitigating actions such as blocking attack-required protocols or removing unnecessary privileges may reduce risk temporarily but could disrupt application functionality.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within WebLogic Server, as well as unauthorized access to all data accessible by the server. This impacts confidentiality and integrity of the system and data but does not affect availability. The vulnerability requires network access via HTTPS and user interaction from a third party, expanding the attack surface. The scope of impact may extend beyond WebLogic Server to additional products due to the interconnected nature of Oracle Fusion Middleware components.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches without delay to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. However, these mitigations may disrupt normal application functionality. Oracle recommends remaining on actively supported versions and promptly applying all relevant patches as the primary mitigation.