What is the CVSS score of CVE-2026-35263?

CVE-2026-35263 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35263?

Organizations deploying Oracle WebLogic Server 14.1.2.0.0 or 15.1.1.0.0 face critical risk of complete server compromise via low-privileged user accounts with minimal exploitation effort, enabling…

How to fix or mitigate CVE-2026-35263?

24 hours: Conduct inventory of all Oracle WebLogic 14.1.2.0.0 and 15.1.1.0.0 instances; restrict HTTP access to production environments where operationally feasible; document application dependencies on affected versions. 7 days: Schedule patch deployment windows for June 2026 CPU (cspujun2026) across all affected systems; perform validation testing in non-production environments. 30 days: Complete deployment of cspujun2026 across entire WebLogic estate; verify patch application per Oracle security advisories.

Oracle WebLogic Server CVE-2026-35263

EUVD-2026-37396 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable HTTP listener (AV:N), vendor calls it easily exploitable (AC:L), any low-privilege WebLogic account suffices (PR:L), no user interaction, full takeover with cross-component impact (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:17 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by a low-privileged attacker over HTTP, with a CVSS 3.1 score of 9.9 driven by a scope change that lets the impact spread beyond WebLogic itself. Oracle has issued the fix in the June 2026 Critical Patch Update (cspujun2026), and there is no public exploit identified at time of analysis. Authenticated but low-effort exploitation combined with full confidentiality, integrity and availability impact makes this a top-priority patching item for any Oracle middleware estate.

Technical ContextAI

Oracle WebLogic Server is a Java EE / Jakarta EE application server widely used to host enterprise applications, web services and integrations on top of Oracle Fusion Middleware. The flaw is in the WebLogic Core component, which handles request dispatch, protocol decoding and the internal object/session model - historically a frequent source of deserialization (CWE-502), authorization bypass (CWE-285) and injection issues in WebLogic. No CWE is published by Oracle (consistent with their CPU disclosure style), but the AV:N/AC:L/PR:L/UI:N/S:C profile and a 'takeover' outcome reachable over HTTP from a low-privileged account is typical of an authenticated-but-trivial protocol-handler or deserialization weakness in T3/IIOP/HTTP listeners. The CPE 'cpe:2.3:a:oracle_corporation:weblogic_server:*' confirms the affected product is the WebLogic Server application server itself, not a bundled component.

RemediationAI

Apply the patch shipped in Oracle's June 2026 Critical Patch Update (cspujun2026) - patch available per vendor advisory at https://www.oracle.com/security-alerts/cspujun2026.html - to both 14.1.2.0.0 and 15.1.1.0.0 deployments; Oracle's documented practice is to require the full CPU bundle rather than individual hotfixes. Until the CPU can be installed, restrict HTTP/HTTPS access to the WebLogic admin and managed-server ports to a small set of trusted management hosts via network ACLs or a reverse proxy, disable or firewall the T3/T3s and IIOP listeners if they are not required (side effect: breaks remote JMX, WLST and some legacy clients), and audit low-privilege accounts on WebLogic to remove unused or default roles since PR:L means any such account is a viable launch point. Increase monitoring on WebLogic access logs and AdminServer.log for anomalous authenticated requests, and place a WAF in front of the application tier to log and rate-limit unusual POST bodies, accepting that a WAF alone is not a reliable mitigation for a scope-changing core-component flaw.