CVE-2026-35292 is an easily exploitable vulnerability in the Console component of Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0. It allows unauthenticated remote attackers to compromise the server via HTTP, resulting in full takeover with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 10.0). The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle’s June 2026 Critical Security Patch Update advisory addresses this and numerous other vulnerabilities, strongly recommending immediate patch application. No specific patch version is explicitly stated in the advisory content provided. Mitigation options include blocking attack vectors at the network level or reducing privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability results in complete compromise of Oracle WebLogic Server, including full control over the server. This affects confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products relying on WebLogic Server may also be impacted. The vulnerability is remotely exploitable without authentication over HTTP, increasing the risk of widespread exploitation if unpatched.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. The vendor advisory does not specify a particular patch version but emphasizes timely patching of supported versions. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation or by restricting privileges and access to vulnerable components, though these measures may impact application functionality. Patch status is not explicitly confirmed in the advisory content provided; users should consult the Oracle advisory URL for the latest remediation details.