CVE-2026-35298 is a critical security vulnerability in Oracle WebLogic Server's core component, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows an attacker with high privileges and network access via HTTP to compromise the WebLogic Server, potentially leading to full server takeover. The vulnerability has a CVSS 3.1 score of 9.1, indicating high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 patches across multiple products. Oracle strongly recommends applying these patches without delay. Mitigations include blocking network protocols required by the attack or removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. The scope of impact may extend beyond WebLogic Server to additional Oracle products that rely on it. The CVSS score of 9.1 reflects critical severity with network attack vector, low attack complexity, and no user interaction required. No known exploits in the wild have been reported yet.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not need them. However, these mitigations may impact application functionality. Oracle recommends staying on actively supported versions and applying security patches without delay.