This vulnerability in Oracle WebLogic Server's core component allows an attacker with low privileges and network access via T3 or IIOP protocols to compromise the server. The CVSS 3.1 base score is 9.9, indicating critical severity with high impact on confidentiality, integrity, and availability. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across various products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can result in complete takeover of the Oracle WebLogic Server, leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is easily exploitable by an attacker with low privileges and network access, increasing the risk of widespread impact. Additionally, the scope of impact may extend to other Oracle products relying on WebLogic Server.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle immediately. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.