This vulnerability in Oracle WebLogic Server Console component affects versions 14.1.2.0.0 and 15.1.1.0.0. It allows a high privileged attacker with network access via HTTP to compromise the server, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its June 2026 Critical Security Patch Update advisory. The advisory urges customers to apply patches promptly and maintain supported versions to prevent exploitation. No specific exploit details or known active exploitation have been disclosed.

Successful exploitation can lead to full compromise of the WebLogic Server, impacting confidentiality, integrity, and availability of the affected system. The attacker must have high privileges and network access via HTTP. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.6. There are no known exploits in the wild reported so far.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users. Oracle recommends remaining on actively supported versions and following the official patch installation instructions provided in the advisory at https://www.oracle.com/security-alerts/cspujun2026.html. Patch status is confirmed as available via this Critical Security Patch Update.