What is the CVSS score of CVE-2026-34315?

CVE-2026-34315 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Oracle WebLogic Server CVE-2026-34315

EUVD-2026-24414 MEDIUM

Improper Authorization (CWE-285)

2026-04-21 oracle

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network HTTP vector with no auth required but mandatory human interaction; integrity-only impact with no confidentiality or availability effect confirmed by description.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:11 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24414

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.5

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).

AnalysisAI

Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server widely used in enterprise middleware deployments, identified via CPE cpe:2.3:a:oracle_corporation:oracle_weblogic_server. The affected component is Web Services, which handles SOAP/REST service endpoints over HTTP. The root cause is CWE-285 (Improper Authorization), meaning the server fails to enforce correct authorization decisions when processing certain requests - consistent with the 'Authentication Bypass' tag in the intelligence data. This class of flaw typically arises when an endpoint either skips an authorization gate or relies on a bypassable check, allowing a crafted HTTP request to be processed with elevated data-modification privileges. The HTTP attack vector and PR:N in the CVSS vector confirm the vulnerable endpoint is exposed over the network without requiring prior authentication.

RemediationAI

Apply the patches released in Oracle's Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html. Oracle does not publish exact patch sub-version identifiers in the advisory synopsis; consult the full CPU patch availability document (PAD) for per-product patch numbers corresponding to each affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0). As a compensating control prior to patching, restrict external network access to WebLogic Web Services endpoints using a Web Application Firewall or network ACLs, which raises the bar for the social-engineering prerequisite by limiting the attacker's ability to craft requests that reach the vulnerable component. Security-awareness measures targeting WebLogic administrators (not clicking unverified links while authenticated to management consoles) are a useful secondary control given the UI:R requirement, though they are not a substitute for patching.