This vulnerability in Oracle WebLogic Server Console component affects versions 14.1.2.0.0 and 15.1.1.0.0. It allows a high privileged attacker with network access via HTTP to compromise the server, resulting in unauthorized creation, deletion, or modification of critical data or all accessible data, as well as unauthorized read access to some data. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N) reflects network attack vector, low attack complexity, high privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. The vulnerability may impact other Oracle products beyond WebLogic Server due to scope change. The vendor advisory does not currently specify a patch or remediation status but strongly recommends applying available patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle WebLogic Server, as well as unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact may extend to additional Oracle products beyond WebLogic Server. No known exploits in the wild have been reported, but the vulnerability is considered easily exploitable by a high privileged attacker with network access.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Until a patch is applied, limit network access to Oracle WebLogic Server consoles to trusted administrators only and monitor for unusual activity consistent with high privileged access misuse.