This vulnerability in Oracle WebLogic Server Console component affects versions 14.1.2.0.0 and 15.1.1.0.0. It requires a high privileged attacker with network access via HTTP to exploit, which is considered difficult. Successful exploitation can lead to full compromise and takeover of the WebLogic Server, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H with a base score of 6.6. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other patches. Oracle strongly recommends applying these patches without delay. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows a high privileged attacker with network access via HTTP to compromise the WebLogic Server, resulting in full takeover. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is considered difficult to exploit and requires high privileges, limiting the attack surface to privileged users with network access.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the official patches promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users who do not need them. These mitigations may affect application functionality. Patch status is confirmed by the vendor advisory. No indication that the vulnerability is already mitigated or requires no action.