CVE-2026-35299 is a vulnerability in Oracle WebLogic Server's Console component affecting versions 12.2.1.4.0 and 14.1.1.0.0. It allows a low privileged attacker with network access via HTTP to compromise the server, potentially resulting in full takeover. The vulnerability is rated with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 new security patches across various Oracle products. Oracle strongly advises customers to apply these patches without delay. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges from users, though these may affect application functionality.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle WebLogic Server, impacting confidentiality, integrity, and availability of the system. An attacker with low privileges and network access via HTTP can leverage this flaw to take over the server.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly. Until patches are applied, risk may be reduced by blocking network protocols required by the attack or by removing unnecessary privileges from users, though these mitigations may disrupt normal application functionality. Patch status is confirmed by the vendor advisory indicating patches are available in the June 2026 update.