This vulnerability in Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the server. The CVSS 3.1 score of 9.8 reflects critical impact across confidentiality, integrity, and availability. The vulnerability is easily exploitable and can result in full server takeover. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security patches, urging customers to apply patches promptly. The advisory does not explicitly state the patch version for this vulnerability, but the update is the authoritative source for remediation.

An unauthenticated attacker with network access to the affected Oracle WebLogic Server versions can exploit this vulnerability to gain full control over the server. This includes complete compromise of confidentiality, integrity, and availability of the server and its data, potentially leading to takeover of the server environment.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the relevant patches from this update without delay. The vendor advisory is the authoritative source for patch availability and installation instructions. Patch status is not explicitly detailed for this CVE in the advisory text provided, so users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.