What is the CVSS score of CVE-2026-34292?

CVE-2026-34292 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-34292?

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are vulnerable to a critical flaw allowing high-privileged administrators to completely compromise the server.

How to fix or mitigate CVE-2026-34292?

Within 24 hours, inventory all systems running Oracle WebLogic Server 12.2.1.4.0 or 14.1.1.0.0 and assess administrator access distribution across your environment; restrict HTTP access to WebLogic administrative interfaces to authorized administrative networks only. Within 7 days, enforce multi-factor authentication for all privileged access to affected systems, enable comprehensive audit logging of all administrative activities, and subscribe to Oracle security advisories to monitor for patch release notifications. Within 30 days, immediately deploy vendor patches to all affected systems as soon as they become available, verify successful deployment across the fleet, and deactivate interim compensating controls once patching is complete.

Oracle WebLogic Server CVE-2026-34292

EUVD-2026-24377 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

GHSA-hhjq-6g7f-p34r

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network HTTP vector with low complexity, but description explicitly requires a high-privileged attacker (PR:H); total takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:19 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24377

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core component) allows a high-privileged, authenticated attacker with HTTP network access to fully compromise the affected instance, resulting in total loss of confidentiality, integrity, and availability. CVSS 3.1 base score is 7.2 (PR:H), and while the intelligence tags reference 'Authentication Bypass,' the CVSS vector requires high privileges, indicating a conflict worth vendor verification. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 12th percentile), and CISA SSVC reports no known exploitation.

Technical ContextAI

Oracle WebLogic Server is a widely deployed Java EE application server within the Oracle Fusion Middleware stack, commonly used to host enterprise web applications and integration tiers exposed over HTTP/T3. The flaw resides in the Core component and is classed as CWE-284 (Improper Access Control), meaning an authorization or access-control check is missing or incorrectly enforced, allowing an actor who already holds elevated privileges to escalate to complete control of the server. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_weblogic_server, spanning the 12.2.1.4.0 and 14.1.1.0.0 release trains. The 'Authentication Bypass' tag suggests the root cause may let an already-authenticated principal bypass an intended access boundary, though the CVSS PR:H metric indicates meaningful privileges are still a prerequisite.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html); Oracle ships this fix as part of the quarterly CPU rather than as a standalone tagged release, so apply the CPU patch appropriate to your 12.2.1.4.0 or 14.1.1.0.0 installation (Patch available per vendor advisory - an independently confirmed standalone fix version is not published in the input). Until the CPU is applied, reduce exposure by restricting HTTP/administrative access to WebLogic to trusted management networks and VPNs, tightening the accounts that hold high privileges (since PR:H is required), and enforcing least-privilege on WebLogic admin and deployment roles to shrink the pool of actors who could exploit this; note these controls limit access but do not remediate the underlying improper access control. Monitor admin-console and management-endpoint activity for anomalous privileged actions as a detective compensating control.