This vulnerability exists in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via T3 or IIOP to compromise the server. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.6, indicating high severity with a confidentiality impact but no integrity or availability impact. The vulnerability's scope is changed, meaning it may affect additional Oracle products beyond WebLogic Server. Oracle has included fixes for this vulnerability in its August 2026 Critical Security Patch Update.

Exploitation of this vulnerability can result in unauthorized access to critical or all data accessible by Oracle WebLogic Server. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing risk. The scope change indicates potential impact on other Oracle products relying on WebLogic Server.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions of Oracle WebLogic Server. Oracle recommends remaining on actively supported versions and applying security updates without delay. No alternative mitigations or workarounds are specified in the advisory.