EUVD-2026-37393Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable Console over HTTPS with no attacker credentials but required victim interaction by an admin yields full triad takeover within the same security scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is achievable by remote unauthenticated attackers via the Console component over HTTPS, provided a victim performs an action such as clicking a malicious link. The flaw carries a CVSS 3.1 base score of 8.8 with high impact across confidentiality, integrity, and availability, but exploitation hinges on user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
WebLogic Server is Oracle's flagship Java EE/Jakarta EE application server used to host mission-critical enterprise applications, and the affected Console component is the browser-based administrative interface used by operators to manage domains, deployments, JDBC sources, and security realms. Although no CWE is published for this entry, the combination of HTTPS attack vector, required user interaction, unauthenticated network access, and unchanged scope is characteristic of a Console-side web flaw such as cross-site request forgery, reflected cross-site scripting, or a deserialization gadget triggered through an authenticated admin's browser session. The affected CPE oracle_corporation:weblogic_server covers both 14.1.2.0.0 and 15.1.1.0.0 release trains, which are Oracle's current Fusion Middleware 14c lines.
RemediationAI
Apply the Oracle Critical Patch Update referenced in the June 2026 CPU advisory at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; exact post-patch build identifiers should be taken from that bulletin and applied to both 14.1.2.0.0 and 15.1.1.0.0 deployments). Until patches are applied, restrict network reachability to the Administration Console by binding it to a dedicated administration port, fronting it with an authenticated reverse proxy or VPN, and blocking external HTTPS access to /console and /em - accepting the trade-off that administrators must use the trusted network path. Additionally, train WebLogic administrators to avoid clicking unsolicited links while authenticated to the Console and consider enforcing short Console session timeouts to shrink the window in which the required user interaction can be abused.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today