This vulnerability affects Oracle WebLogic Server (component: Core) in versions 12.2.1.4.0 and 14.1.1.0.0. It is an easily exploitable flaw that allows unauthenticated attackers with network access via HTTP to compromise the server. Successful exploitation can lead to complete takeover of the Oracle WebLogic Server instance. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and impacts confidentiality, integrity, and availability at a high level. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 security patches but does not explicitly confirm patch availability or remediation status for these specific versions within the provided content.

The vulnerability enables unauthenticated remote attackers to fully compromise Oracle WebLogic Server, affecting confidentiality, integrity, and availability. This can result in complete server takeover, posing a critical risk to affected systems.

Oracle has released a Critical Patch Update advisory in July 2026 that includes security patches addressing this vulnerability. Users should promptly review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches to affected Oracle WebLogic Server versions. Patch status is not explicitly confirmed in the advisory content provided here; therefore, users must verify patch availability and installation instructions directly from Oracle's official advisory. No alternative mitigations or workarounds are stated.