This vulnerability in Oracle WebLogic Server Console component affects versions 12.2.1.4.0 and 14.1.1.0.0. It allows an unauthenticated remote attacker with network access via HTTP to compromise the server, contingent on human interaction by a third party. The vulnerability causes a scope change, potentially impacting other Oracle products beyond WebLogic Server. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects network attack vector, high attack complexity, no privileges required, required user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update advisory addresses this vulnerability among others and strongly urges customers to apply patches promptly. Until patches are applied, risk mitigation may include blocking relevant network protocols and restricting privileges to reduce attack surface, though these may affect functionality.

Successful exploitation can result in complete takeover of the WebLogic Server, compromising confidentiality, integrity, and availability of the affected system. The vulnerability also has a scope change, meaning it can significantly impact additional Oracle products beyond WebLogic Server. The attack requires network access via HTTP and user interaction from a person other than the attacker, making exploitation difficult but potentially severe.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to remediate this vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for the attack and by removing unnecessary privileges or access to vulnerable packages from users who do not need them. These mitigations may disrupt application functionality, so they should be tested carefully. Patch status is not explicitly stated in the advisory excerpt, but the Critical Security Patch Update contains fixes addressing this vulnerability. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.