CVE-2026-35298 is a critical security vulnerability in the Core component of Oracle Fusion Middleware WebLogic Server. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an attacker with high privileges and network access over HTTP to compromise the WebLogic Server, potentially resulting in full server takeover. The vulnerability has a CVSS 3.1 score of 9.1, indicating high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. Oracle strongly recommends applying these patches without delay. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. Because WebLogic Server is a core middleware product, the impact may extend to additional integrated products, resulting in a broader scope of compromise.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users, though these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security updates. Patch status is confirmed as available via the June 2026 Critical Security Patch Update.