CVE-2026-35300 is a critical security vulnerability in Oracle WebLogic Server's core component, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via TCP to compromise the server, potentially leading to full takeover. The vulnerability has a CVSS 3.1 score of 9.8 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 patches across multiple products. Oracle strongly recommends applying these patches immediately. Workarounds include blocking attack-related network protocols and removing unnecessary privileges, but these may disrupt application functionality.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to completely compromise Oracle WebLogic Server, impacting confidentiality, integrity, and availability of the system. This can lead to full server takeover.

Oracle has released security patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is not explicitly confirmed in the advisory text but is implied by the Critical Security Patch Update; customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.