This vulnerability affects Oracle WebLogic Server (component: Core) in versions 14.1.2.0.0 and 15.1.1.0.0. It is easily exploitable by a low privileged attacker with network access via HTTP, allowing compromise of the WebLogic Server and potentially impacting additional Oracle products. The CVSS 3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level. Oracle strongly recommends applying security patches promptly and suggests network and privilege restrictions as temporary mitigations.

Successful exploitation can result in complete takeover of the WebLogic Server, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond WebLogic Server. The CVSS score of 9.9 reflects critical impact with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to address this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or package access from users. These mitigations may impact application functionality, so patching is the preferred solution. Patch status is not explicitly confirmed in the advisory; customers should monitor Oracle's official security alerts for patch availability and installation instructions.