What is the CVSS score of CVE-2026-35298?

CVE-2026-35298 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35298?

CVE-2026-35298 is a critical vulnerability in Oracle WebLogic Server (Fusion Middleware Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 that enables high-privileged…

How to fix or mitigate CVE-2026-35298?

Within 24 hours: Inventory all WebLogic deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0; restrict administrative network access via firewall rules; enable detailed audit logging of administrative activities. Within 7 days: Implement network segmentation isolating WebLogic instances from general enterprise networks; revoke or restrict standing high-privilege account access; deploy continuous monitoring for abnormal administrative access patterns. Within 30 days: Develop and execute upgrade plan to unaffected versions; monitor Oracle security advisories for patch availability; conduct comprehensive security assessment of WebLogic authentication and authorization configurations.

Oracle WebLogic Server CVE-2026-35298

EUVD-2026-37424 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

HTTP-reachable management surface (AV:N/AC:L), high WebLogic role required per Oracle (PR:H), no user interaction, and confirmed scope change with full C/I/A takeover.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:32 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Authenticated takeover of Oracle WebLogic Server (Fusion Middleware Core component) is possible by a high-privileged attacker over HTTP, with a scope change that can impact additional products beyond WebLogic itself. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a CVSS 3.1 base score of 9.1. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebLogic Server is a Java EE/Jakarta EE application server widely deployed as middleware for enterprise applications, identity flows, and SOA integrations. The flaw resides in the WebLogic Core component, which handles request dispatch, internal management interfaces, and inter-component trust boundaries, so a defect here can cross the trust line into co-hosted Fusion Middleware products (reflected in CVSS Scope:Changed). Oracle did not assign a CWE, but the combination of high privileges required plus full C/I/A impact and scope change is characteristic of post-authentication management-plane abuse such as deserialization, JNDI/T3-style lookups, or privileged operation gaps in the core runtime, rather than a parsing bug in an unauthenticated edge surface.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) for each affected WebLogic Server release line - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - patch available per vendor advisory; exact post-patch build numbers should be taken directly from the Oracle CPU patch matrix rather than invented here. Until the CPU is applied, reduce exposure by restricting network access to the WebLogic Administration Console, T3/T3s, IIOP, and management HTTP endpoints to a jump-host or admin VLAN (trade-off: breaks remote ops tooling), enforcing MFA and strong rotation on all WebLogic admin and operator accounts, and reviewing role assignments to remove latent high-privilege users (trade-off: may temporarily break automation that runs as admin). Enable detailed audit logging on the Admin Server and monitor for anomalous admin-authenticated operations as a compensating detection control.