CVE-2026-35301 is a critical security vulnerability in Oracle WebLogic Server's Console component affecting versions 12.2.1.4.0 and 14.1.1.0.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise the server, resulting in full takeover. The vulnerability has a CVSS 3.1 score of 10.0, reflecting complete compromise of confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches immediately to prevent exploitation. Mitigation options prior to patching include blocking network protocols required for the attack and removing unnecessary privileges, though these may disrupt normal operations. No public exploits have been observed so far.

Successful exploitation of this vulnerability allows unauthenticated remote attackers to fully compromise Oracle WebLogic Server, leading to complete loss of confidentiality, integrity, and availability of the affected system. This can result in full server takeover and may impact additional products relying on WebLogic Server. The vulnerability is easily exploitable over HTTP without authentication.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible to remediate the issue. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. These mitigations may affect application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security updates. Patch status is confirmed by the vendor advisory.