This vulnerability exists in the Web Container component of Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, allowing them to compromise the server fully. The CVSS 3.1 base score is 10.0, indicating critical severity with complete impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability, and customers are strongly advised to apply these updates promptly.

Successful exploitation results in complete takeover of Oracle WebLogic Server, leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread impact. Additionally, the scope change means that other Oracle products relying on WebLogic Server may also be affected.

Oracle has released patches for this vulnerability in their September 2026 Critical Security Patch Update. Affected customers should apply the official patches immediately to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.