This vulnerability affects Oracle WebLogic Server (component: Core) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It is easily exploitable by unauthenticated attackers with network access via TCP, allowing full compromise and takeover of the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 security patches. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle WebLogic Server, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to full server takeover, posing a critical risk to affected environments.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges from users who do not require them. However, these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is not explicitly stated in the advisory but is implied by the availability of the Critical Security Patch Update.