What is the CVSS score of CVE-2026-35291?

CVE-2026-35291 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

WebLogic Server CVE-2026-35291

EUVD-2026-37418 MEDIUM

Improper Privilege Management (CWE-269)

2026-06-16 oracle

Oracle Weblogic Server Privilege Escalation

6.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Network vector confirmed via HTTP access; PR:H because exploitation requires high-privileged Console credentials; AC:H reflects unspecified but non-trivial exploit preconditions per Oracle description.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:19 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover is possible in Oracle WebLogic Server's Console component, affecting versions 14.1.2.0.0 and 15.1.1.0.0 via HTTP over a network. Exploitation requires a high-privileged attacker and high attack complexity, limiting the realistic threat surface to scenarios where administrative credentials are already compromised or an insider threat is present. No public exploit code and no CISA KEV listing have been identified at the time of analysis; this was disclosed as part of Oracle's Critical Patch Update (CPU) for June 2026.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server and part of the Oracle Fusion Middleware stack. The affected component is the administrative Console, a web-based management interface typically exposed over HTTP/HTTPS. The CPE string (cpe:2.3:a:oracle_corporation:weblogic_server:*:*:*:*:*:*:*:*) covers both affected release trains: 14.1.2.0.0 and 15.1.1.0.0. No CWE is disclosed - Oracle's CPU advisories routinely omit root-cause classification - so the specific vulnerability class (e.g., deserialization, SSRF, injection) cannot be confirmed from available data. The CVSS impact metrics (C:H/I:H/A:H with scope unchanged) indicate that successful exploitation results in complete compromise of the WebLogic Server instance itself. Notably, the advisory tags include 'Information Disclosure,' which is narrower than the full C/I/A impact suggested by the CVSS score; this discrepancy likely reflects tag-level categorization inconsistency rather than a contradiction in the underlying data.

RemediationAI

Apply the patches released in Oracle's Critical Patch Update for June 2026, available at https://www.oracle.com/security-alerts/cspujun2026.html. An exact fixed version number beyond the CPU release itself is not specified in the available data; consult the Oracle CPU patch matrix for the precise patch set identifier for WebLogic 14.1.2.0.0 and 15.1.1.0.0. As a compensating control, restrict access to the WebLogic Administration Console to a dedicated, firewalled management network segment, preventing general network reachability over HTTP - this directly addresses AV:N and significantly raises the bar for exploitation without disabling the Console entirely. Enforce multi-factor authentication on administrative accounts where supported, and audit all high-privileged WebLogic accounts to reduce the PR:H attack surface. Disabling the Console entirely on production nodes that do not require it is a high-confidence workaround but will prevent all web-based administrative operations.