This vulnerability affects Oracle WebLogic Server (component: Console) in versions 14.1.2.0.0 and 15.1.1.0.0. It enables a low privileged attacker with access to the infrastructure where WebLogic Server runs to compromise the server, contingent on human interaction from a person other than the attacker. The vulnerability impacts confidentiality and integrity, allowing unauthorized creation, deletion, or modification of critical data accessible by WebLogic Server. The scope of impact extends beyond WebLogic Server to other Oracle products. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N with a base score of 7.9. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly urges customers to apply patches without delay. No explicit patch or remediation level is stated in the advisory excerpt, but Oracle's general guidance is to apply the Critical Security Patch Update promptly. Workarounds include blocking required network protocols or removing unnecessary privileges, though these may affect functionality.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data accessible by WebLogic Server, leading to high confidentiality and integrity impacts. The vulnerability requires low attacker privileges and human interaction, with no impact on availability. The scope of the vulnerability extends beyond WebLogic Server, potentially affecting additional Oracle products. This can lead to significant compromise of data and system integrity within affected environments.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to packages for users who do not require them. These mitigations may impact application functionality. No official patch or temporary fix status is explicitly stated in the advisory excerpt, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.