This vulnerability in Oracle WebLogic Server's core component allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the server, potentially leading to full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires no privileges or user interaction and can be executed remotely with low complexity. Affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The Oracle July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this CVE in the provided content. Oracle strongly recommends applying security patches promptly to mitigate known vulnerabilities.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle WebLogic Server, impacting confidentiality, integrity, and availability. This can lead to complete server takeover, posing a critical risk to affected environments.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to T3 and IIOP protocols to trusted sources only.