What is the CVSS score of CVE-2026-35292?

CVE-2026-35292 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35292?

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 contain a critical unauthenticated remote code execution vulnerability in the Console component allowing complete server compromise without…

How to fix or mitigate CVE-2026-35292?

Within 24 hours: Inventory all Oracle WebLogic Server 14.1.x and 15.1.x instances; determine network exposure and accessibility from untrusted sources; review access logs for suspicious activity patterns. Within 7 days: Implement strict network access controls (ACLs/firewall rules) restricting WebLogic Console ports (default 7001/7002) to trusted administrative networks only; disable the administrative Console if operationally feasible; deploy WAF rules targeting Console-based attacks; enable detailed monitoring and alerting. Within 30 days: Establish a patch management plan for when Oracle releases a fix in a subsequent Critical Patch Update; prioritize affected systems for patching; maintain enhanced monitoring for systems that cannot be immediately upgraded.

Oracle WebLogic Server CVE-2026-35292

EUVD-2026-37419 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Console is reachable over HTTP without authentication or user interaction (AV:N/AC:L/PR:N/UI:N); vendor confirms takeover with cross-product impact, supporting S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:29 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows network attackers to fully compromise the server over HTTP with no user interaction, earning the maximum CVSS 10.0 due to a scope change that can impact adjacent products. Oracle's June 2026 Critical Patch Update is the sole intelligence source; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

WebLogic Server is Oracle's Java EE/Jakarta EE application server used to host enterprise web and SOA applications, and the affected component is the administrative Console - a privileged web interface historically targeted by deserialization, T3/IIOP, and request-routing flaws (CVE-2020-14882, CVE-2023-21839, CVE-2024-21181). The CPE 'cpe:2.3:a:oracle_corporation:weblogic_server' confirms the affected product but is not version-pinned in the feed; Oracle's advisory text pins exposure to 14.1.2.0.0 and 15.1.1.0.0. No CWE is supplied, but the combination of pre-auth HTTP exploitation, scope change, and full CIA impact is consistent with the Console authentication-bypass / RCE class of bug that has dominated prior WebLogic Critical Patch Updates.

RemediationAI

Apply Oracle's June 2026 Critical Patch Update (cpujun2026) immediately to WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 - see https://www.oracle.com/security-alerts/cspujun2026.html for the exact patch bundle; specific patched build numbers are not enumerated in the feed and must be confirmed in the Oracle advisory matrix. Until the CPU is staged, the highest-value compensating control is to remove the Administration Console from any network reachable by untrusted clients: either disable the Console via the WebLogic Admin Console setting 'Console Enabled = false' (side effect: loss of browser-based administration, forcing WLST/REST for changes), or restrict access at the network layer by binding the admin port to a management VLAN and blocking the Console URI (/console, /consolehelp) at the upstream reverse proxy or WAF (side effect: legitimate admin sessions must originate from the allow-listed network). T3/IIOP filtering and connection filters are not sufficient on their own here because the vulnerability is reachable over HTTP.