This vulnerability affects Oracle WebLogic Server (component: Console) in versions 14.1.2.0.0 and 15.1.1.0.0. It is easily exploitable by a low privileged attacker who has logon access to the infrastructure where WebLogic Server runs. Exploitation requires user interaction from a third party. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within WebLogic Server, resulting in a significant confidentiality and integrity breach. The vulnerability also affects the security scope, potentially impacting other Oracle products. Oracle has published a Critical Security Patch Update advisory for June 2026 that includes this vulnerability among 245 security patches. The advisory strongly recommends applying the patches promptly. No explicit patch or fix version is stated for this vulnerability in the provided data, and the remediation level is not specified. Oracle recommends applying the Critical Security Patch Update without delay and suggests risk reduction by blocking network protocols required for exploitation or removing unnecessary privileges, though these may impact functionality.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data accessible by WebLogic Server, resulting in high confidentiality and integrity impact. The vulnerability requires low attacker privileges but does require human interaction from a user other than the attacker. The scope of impact extends beyond WebLogic Server to additional Oracle products. There is no availability impact reported. The CVSS 3.1 score of 7.9 reflects these impacts.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and removing unnecessary privileges or access to packages from users who do not need them. However, these mitigations may disrupt application functionality. No official fix or patch version is explicitly stated in the advisory content provided, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.