This vulnerability in Oracle WebLogic Server's core component permits an attacker with low privileges and network access over HTTP to compromise the server. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not specifically confirm a patch for this CVE in the provided excerpt. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to complete compromise of Oracle WebLogic Server, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the server, potentially leading to unauthorized data access, modification, or service disruption.

Oracle's July 2026 Critical Patch Update advisory strongly recommends applying security patches without delay and remaining on actively supported versions. However, patch availability for this specific vulnerability and affected versions is not explicitly confirmed in the provided data. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch and remediation information. Until patches are confirmed and applied, consider restricting network access to Oracle WebLogic Server instances and monitoring for unusual activity.