Oracle WebLogic Server CVE-2026-34305

Exploitation targets the Web Services component of Oracle WebLogic Server and requires only HTTP network reachability to that component's endpoint; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and low attack complexity. What limits exploitation is primarily network exposure: the WebLogic Web Services endpoint must be reachable by the attacker, so instances behind firewalls, VPNs, or IP allow-lists are substantially less exposed. The affected versions are limited to 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, so other releases are outside this CVE's stated scope. Impact is confined to confidentiality (data disclosure), not code execution or data modification.

Signals are mixed and warrant careful prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, network-reachable, unauthenticated attack, which raises the base score to 7.5 and normally justifies urgent patching for internet-facing WebLogic instances. However, the EPSS score is extremely low (0.03%, 9th percentile), and CISA's SSVC framework rates Exploitation as 'poc', Automatable as 'no', and Technical Impact as 'partial' - indicating that while proof-of-concept code exists, mass automated exploitation is not currently observed and impact is limited to information disclosure (no code execution or data modification). This is a real priority for exposed, internet-facing WebLogic servers given the unauthenticated network vector, but it is not a wormable, high-velocity threat like prior WebLogic RCEs. Note the conflict worth flagging: the input Tags include 'Authentication Bypass', yet the CWE (CWE-200) and CVSS impact profile (C:H/I:N/A:N) point to information disclosure, not a true authentication bypass - treat the 'Authentication Bypass' tag with caution and verify against Oracle's advisory. This is not on CISA KEV, so there is no confirmation of active in-the-wild exploitation.

An attacker with only HTTP access to an internet-facing or internally reachable WebLogic server sends a crafted request to a Web Services endpoint and, without any credentials, receives sensitive server-side data in the response. Because proof-of-concept exploit code exists (per SSVC) and no authentication or user interaction is required, an opportunistic attacker scanning for exposed WebLogic instances could harvest confidential data, though the SSVC 'Automatable: no' rating suggests exploitation is not trivially mass-scalable.