This vulnerability in Oracle WebLogic Server's core component allows an unauthenticated attacker with network access via the IIOP protocol to compromise the server. The flaw affects specific versions of Oracle WebLogic Server (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and can result in complete confidentiality, integrity, and availability compromise. Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple products. Oracle advises customers to apply these patches without delay to mitigate exploitation risks.

Successful exploitation allows an unauthenticated attacker to take over Oracle WebLogic Server, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data breaches, and disruption of services.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply the provided patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patches.