This vulnerability (CVE-2026-35259) affects Oracle WebLogic Server's Console component in versions 14.1.2.0.0 and 15.1.1.0.0. It is exploitable remotely over HTTPS by unauthenticated attackers but requires user interaction from a person other than the attacker. The vulnerability can lead to complete compromise of the WebLogic Server, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, but requires user interaction, with high impact on all security properties. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 others, though the advisory does not explicitly confirm a standalone patch or remediation level. Oracle urges customers to apply the update promptly to reduce risk.

Successful exploitation of this vulnerability can result in full takeover of the Oracle WebLogic Server, compromising confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via HTTPS can exploit this issue, but it requires user interaction from a third party. The impact is rated high with a CVSS score of 8.8.

Oracle's June 2026 Critical Security Patch Update includes fixes addressing this vulnerability. Customers are strongly advised to apply this update as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or removing unnecessary privileges and package access from users, though these measures may affect application functionality. Oracle does not provide a specific standalone patch for this vulnerability outside the Critical Security Patch Update. Patch status is not explicitly confirmed beyond the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.