CVE-2026-35292 is an easily exploitable vulnerability in Oracle WebLogic Server's Console component affecting versions 14.1.2.0.0 and 15.1.1.0.0. It allows unauthenticated attackers with network access via HTTP to compromise the server, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 10.0, reflecting critical impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this and other vulnerabilities, strongly recommending customers apply patches promptly. While no specific patch version is cited for this CVE, Oracle's advisory emphasizes the importance of applying the update to mitigate the risk. Workarounds include blocking attack-related network protocols and restricting privileges, though these may affect application functionality.

Successful exploitation of CVE-2026-35292 can lead to complete compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. This may also impact additional products due to scope change. The vulnerability is exploitable remotely without authentication via HTTP, making it highly critical. No known exploits in the wild have been reported yet.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users. These mitigations may disrupt application functionality, so they should be implemented cautiously. Patch status is not explicitly confirmed for this CVE in the advisory; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and instructions.