This vulnerability exists in the Console component of Oracle WebLogic Server within Oracle Fusion Middleware. It is easily exploitable by a high privileged attacker with network access over HTTPS, enabling compromise of the WebLogic Server. The CVSS 3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and urges customers to apply patches without delay to mitigate exploitation risks.

Successful exploitation can result in complete takeover of the Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to execute arbitrary code or disrupt services. The vulnerability requires high privileges and network access via HTTPS.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing this vulnerability. Customers are strongly advised to apply the official patches promptly. No specific temporary mitigations or workarounds are provided in the advisory. Patch status is not explicitly confirmed for this vulnerability alone, but the vendor advisory indicates patches are available as part of the Critical Patch Update. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patching instructions and ensure they are running actively supported versions with applied security updates.