EUVD-2026-37392Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
HTTPS-reachable Console (AV:N/AC:L), attacker needs a low-privileged account (PR:L), a second user must interact (UI:R), scope changes into other Fusion Middleware (S:C); data is read/modified but no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all WebLogic Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
AnalysisAI
Cross-scope data compromise in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged remote attacker over HTTPS to read, create, modify, or delete critical data through the administration Console, provided a separate user is induced to perform an action. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact with scope change reaching beyond WebLogic itself, and no public exploit identified at time of analysis.
Technical ContextAI
WebLogic Server is Oracle's Java EE/Jakarta EE application server used to host enterprise web applications, JMS messaging, and SOAP/REST services within Oracle Fusion Middleware deployments. The affected component is the WebLogic administration Console, a browser-based management interface used by operators to deploy applications, configure data sources, and manage security realms over HTTPS. No CWE is published for this entry, but the CVSS vector (PR:L, UI:R, scope change, C:H/I:H/A:N) is characteristic of a console-side weakness - most commonly cross-site request forgery, stored cross-site scripting, or a similar request-handling flaw - where a low-privileged Console user acts as the pivot to coerce a higher-privileged operator's browser session into performing privileged actions affecting other Fusion Middleware components. The CPE cpe:2.3:a:oracle_corporation:weblogic_server names the affected product, while the description constrains the impact to versions 14.1.2.0.0 and 15.1.1.0.0.
RemediationAI
Apply the Oracle Critical Patch Update from June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html, which is the patch available per vendor advisory for WebLogic Server 14.1.2.0.0 and 15.1.1.0.0; an exact patched build number is not stated in the input data and should be taken from the Oracle CPU patch matrix. Until the CPU can be applied, restrict network access to the WebLogic administration Console so it is reachable only from a management VLAN or jump host (this breaks browser-based admin from user workstations and may require VPN/bastion workflow changes), and minimize the number of accounts granted any Console role, especially the low-privileged roles that satisfy PR:L. Operators should avoid clicking links or following navigation prompts inside or originating from the Console while authenticated, since the vulnerability requires interaction by a user other than the attacker; enforcing per-session admin browsers and short Console session timeouts reduces the window in which a CSRF- or XSS-style trigger can fire.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today