What is the CVSS score of CVE-2026-35258?

CVE-2026-35258 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35258?

Oracle WebLogic Server versions 14.1 and 15.1 contain a high-severity vulnerability (CVSS 8.7) with no public exploit identified at time of analysis that could allow attackers to read, modify, or…

How to fix or mitigate CVE-2026-35258?

24 HOURS: Inventory all systems running WebLogic 14.1.2.0.0 or 15.1.1.0.0; restrict administrative console access to trusted internal networks only; enable detailed audit logging for all console activities; issue security awareness notice to administrators regarding social engineering threats. 7 DAYS: Deploy multi-factor authentication for all WebLogic administrative accounts; implement IP whitelist restrictions on console access; disable remote access to HTTP(S)-based console if operationally feasible. 30 DAYS: Establish vendor notification monitoring for patch release; develop and test upgrade pathway to patched WebLogic versions; conduct access control audit and administrator training.

Oracle WebLogic Server CVE-2026-35258

EUVD-2026-37392 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-06-16 oracle

Authentication Bypass Oracle Weblogic Server Open Redirect

8.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.7 HIGH

HTTPS-reachable Console (AV:N/AC:L), attacker needs a low-privileged account (PR:L), a second user must interact (UI:R), scope changes into other Fusion Middleware (S:C); data is read/modified but no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:15 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all WebLogic Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Cross-scope data compromise in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged remote attacker over HTTPS to read, create, modify, or delete critical data through the administration Console, provided a separate user is induced to perform an action. The CVSS 3.1 base score of 8.7 reflects high confidentiality and integrity impact with scope change reaching beyond WebLogic itself, and no public exploit identified at time of analysis.

Technical ContextAI

WebLogic Server is Oracle's Java EE/Jakarta EE application server used to host enterprise web applications, JMS messaging, and SOAP/REST services within Oracle Fusion Middleware deployments. The affected component is the WebLogic administration Console, a browser-based management interface used by operators to deploy applications, configure data sources, and manage security realms over HTTPS. No CWE is published for this entry, but the CVSS vector (PR:L, UI:R, scope change, C:H/I:H/A:N) is characteristic of a console-side weakness - most commonly cross-site request forgery, stored cross-site scripting, or a similar request-handling flaw - where a low-privileged Console user acts as the pivot to coerce a higher-privileged operator's browser session into performing privileged actions affecting other Fusion Middleware components. The CPE cpe:2.3:a:oracle_corporation:weblogic_server names the affected product, while the description constrains the impact to versions 14.1.2.0.0 and 15.1.1.0.0.

RemediationAI

Apply the Oracle Critical Patch Update from June 2026 referenced at https://www.oracle.com/security-alerts/cspujun2026.html, which is the patch available per vendor advisory for WebLogic Server 14.1.2.0.0 and 15.1.1.0.0; an exact patched build number is not stated in the input data and should be taken from the Oracle CPU patch matrix. Until the CPU can be applied, restrict network access to the WebLogic administration Console so it is reachable only from a management VLAN or jump host (this breaks browser-based admin from user workstations and may require VPN/bastion workflow changes), and minimize the number of accounts granted any Console role, especially the low-privileged roles that satisfy PR:L. Operators should avoid clicking links or following navigation prompts inside or originating from the Console while authenticated, since the vulnerability requires interaction by a user other than the attacker; enforcing per-session admin browsers and short Console session timeouts reduces the window in which a CSRF- or XSS-style trigger can fire.