This vulnerability (CVE-2026-35301) affects Oracle WebLogic Server Console component in versions 12.2.1.4.0 and 14.1.1.0.0. It is an easily exploitable flaw that requires no authentication and can be triggered remotely over HTTP. Successful exploitation results in complete compromise of the WebLogic Server, with full confidentiality, integrity, and availability impacts (CVSS 3.1 score 10.0). The vulnerability also has a scope change effect, potentially impacting other Oracle products relying on WebLogic Server. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly urges customers to apply patches promptly. Until patches are applied, risk reduction may be achieved by blocking required network protocols or removing unnecessary privileges, though these may affect functionality.

An unauthenticated attacker with network access via HTTP can fully compromise the WebLogic Server, resulting in complete loss of confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products dependent on WebLogic Server may also be significantly impacted. The vulnerability has a maximum CVSS score of 10.0, indicating critical severity and potential for total system takeover.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, customers may reduce risk by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users. These mitigations may disrupt application functionality and should be applied cautiously. Monitor Oracle's official advisory for patch availability and installation instructions. Patch status is not explicitly confirmed in the advisory text provided; therefore, check the vendor advisory for current remediation guidance.