This vulnerability affects Oracle WebLogic Server, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an unauthenticated attacker with network access via TCP to compromise the server, potentially resulting in complete takeover. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes patches addressing this vulnerability among many others. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to full compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access can execute this attack, making it highly critical. There are no known exploits in the wild at the time of publication, but the risk remains significant due to the ease of exploitation and potential impact.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability. Customers should review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches for Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or temporary fixes are indicated in the advisory.