This vulnerability in Oracle WebLogic Server's core component allows an unauthenticated remote attacker with network access via T3 or IIOP protocols to compromise the server. The flaw is difficult to exploit but can lead to full server takeover if successfully exploited. The affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products.

Successful exploitation can result in complete compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the server remotely without authentication, posing a significant security risk to affected environments.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively-supported versions and promptly applying all security patches. No indication was given that the vulnerability is already mitigated or requires no action.