What is the CVSS score of CVE-2026-34305?

CVE-2026-34305 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-34305?

Oracle WebLogic Server (Fusion Middleware) versions 12.2.1.4.0 through 15.1.1.0.0 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access all data…

How to fix or mitigate CVE-2026-34305?

Within 24 hours: Inventory all Oracle WebLogic Server instances organization-wide and identify systems running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; catalog the sensitivity and criticality of data accessible to each instance. Within 7 days: Implement network-level access restrictions to limit HTTP access to affected WebLogic servers to authorized internal networks only; deploy WAF rules configured to block known exploitation patterns for CVE-2026-34305; enable enhanced logging and alerting for all Web Services component access. Within 30 days: Establish direct communication with Oracle to confirm patch release timelines and interim guidance; develop and execute a patching schedule for when vendor updates become available; evaluate architectural mitigations such as network segmentation of Web Services components or deployment behind authentication proxies as alternative controls pending patch release.

Oracle WebLogic Server CVE-2026-34305

EUVD-2026-24399 HIGH

Information Exposure (CWE-200)

2026-04-21 oracle

Authentication Bypass Information Disclosure Oracle Oracle Weblogic Server Oracle Corporation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote HTTP access with low complexity (PR:N/AV:N/AC:L) yields confidentiality-only disclosure (C:H, I:N, A:N) per CWE-200 information exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:14 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24399

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).

Technical ContextAI

The affected technology is Oracle WebLogic Server, a Java EE application server that is a core component of Oracle Fusion Middleware and hosts enterprise web applications and services. The vulnerable component is the Web Services subsystem, which processes SOAP/HTTP requests - a historically attractive attack surface in WebLogic due to XML/deserialization and endpoint-parsing issues. The root cause class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the server discloses data it should protect rather than executing attacker code; consistent with this, the CVSS vector marks confidentiality High but integrity and availability None. The single CPE provided (cpe:2.3:a:oracle_corporation:oracle_weblogic_server:*) confirms the Oracle WebLogic Server application as the affected product without narrowing to a specific patch level beyond the enumerated versions.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of April 2026, referenced at https://www.oracle.com/security-alerts/cpuapr2026.html, for each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0); Patch available per vendor advisory, though no single exact fixed build number is provided in the available data, so consult the CPU matrix for the specific patch/PSU for your version. Until patching, reduce exposure by restricting network access to the WebLogic administrative and Web Services ports so they are not reachable from untrusted networks, placing the server behind a VPN or IP allow-list, and disabling or removing unused web service endpoints in the Web Services component - with the trade-off that restricting endpoints or ports may break legitimate SOAP/HTTP integrations and remote management, so validate application dependencies before applying. A WAF rule filtering anomalous requests to the Web Services endpoints can serve as an additional compensating control but should not be relied on as a sole fix.