This vulnerability in Oracle WebLogic Server's core component affects versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable over the network via HTTP by an attacker with low privileges, enabling compromise of the server with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8). The vulnerability is tracked as CWE-284 (Improper Access Control). Oracle's June 2026 Critical Security Patch Update advisory references this and other vulnerabilities, urging customers to apply patches without delay. While the advisory lists affected products and versions, it does not explicitly confirm patch availability or remediation status for WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0. Oracle recommends applying the Critical Security Patch Update and suggests network and privilege restrictions as interim mitigations.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebLogic Server, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected server. The CVSS 3.1 base score of 8.8 reflects the high severity and broad impact of this vulnerability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not require them. These mitigations may affect application functionality and should be implemented with caution. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle advisory for the latest patch availability and installation instructions.