CVE-2026-35311 affects Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 and is classified as a high-severity vulnerability with a CVSS 3.1 score of 8.8. It allows a low privileged attacker with network access over HTTP to compromise the WebLogic Server, potentially resulting in full server takeover. The vulnerability impacts confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. The vendor advisory strongly urges customers to apply these patches without delay and notes that failure to patch has led to successful exploitation attempts. Mitigation options prior to patching include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the server, potentially leading to unauthorized access, data breaches, and disruption of services.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk can be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users. However, these mitigations may impact application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the June 2026 Critical Security Patch Update advisory.