This vulnerability affects Oracle WebLogic Server (component: Core) in versions 14.1.2.0.0 and 15.1.1.0.0. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of the WebLogic Server. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. While the vulnerability is in WebLogic Server, exploitation may affect additional Oracle products due to scope change. Oracle has included a fix for this vulnerability in its June 2026 Critical Security Patch Update. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can result in complete takeover of the WebLogic Server, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required. This poses a critical risk to organizations running the affected versions of WebLogic Server. Additionally, the compromise may affect other Oracle products that depend on WebLogic Server.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users to limit attack surface, though these may impact functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.