What is the CVSS score of CVE-2026-35299?

CVE-2026-35299 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35299?

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 contain a vulnerability in the administrative Console that allows any authenticated user to gain complete server control, enabling full…

How to fix or mitigate CVE-2026-35299?

24 HOURS: Audit all Oracle WebLogic Server installations to identify systems running versions 12.2.1.4.0 or 14.1.1.0.0; immediately restrict WebLogic Console network access to administrative networks only and inventory all Console users. 7 DAYS: Implement multi-factor authentication for Console access where technically feasible; deploy network monitoring on Console endpoints (port 7002 by default) to detect exploitation attempts; audit recent Console access logs for suspicious activity. 30 DAYS: Subscribe to Oracle Security Alerts for patch availability; develop and test patch deployment plan; evaluate architectural changes to reduce Console exposure (e.g., administrative bastion hosts, Console access tiering).

Oracle WebLogic Server CVE-2026-35299

EUVD-2026-37425 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Console reachable over HTTP (AV:N), no special timing or config (AC:L), any authenticated WebLogic role suffices (PR:L), no user interaction, and full server takeover yields C:H/I:H/A:H within the JVM scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:32 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authenticated takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is achievable through the administrative Console component, where a low-privileged HTTP-authenticated attacker can fully compromise confidentiality, integrity, and availability of the server. Oracle reports the issue as easily exploitable and rates it CVSS 8.8, though no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV. The flaw poses a significant risk to enterprise Java EE deployments where the WebLogic Console is reachable by any authenticated user.

Technical ContextAI

Oracle WebLogic Server is an enterprise-grade Java EE/Jakarta EE application server used to host mission-critical web applications, web services, and middleware integrations. The affected Console component is the browser-based administrative interface (typically reached at /console) used for deploying applications, managing JDBC/JMS resources, and configuring server runtime behavior. Historically, WebLogic Console flaws have stemmed from unsafe deserialization (CWE-502), authentication/authorization bypass (CWE-287/CWE-863), and server-side request handling weaknesses; while this specific CVE has no CWE assigned in the provided data, the combination of CVSS S:U with C:H/I:H/A:H impacts within the Console component is consistent with that lineage of post-auth deserialization or privileged-action gadgets that grant control over the JVM process. The CPE 'cpe:2.3:a:oracle_corporation:weblogic_server:*' confirms the WebLogic Server application stack as the affected target, rather than the underlying Fusion Middleware infrastructure.

RemediationAI

Apply the patch available per vendor advisory by installing the June 2026 Oracle Critical Patch Update for WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; exact fix patch numbers are listed in the CPU matrix and should be applied to each managed server in the domain followed by a rolling restart. As compensating controls until patching, restrict network access to the /console URI to a management VLAN or jump host (this is the canonical Oracle-recommended mitigation and has minimal functional side effects since end users do not need Console access), enforce strong unique credentials and MFA-fronted SSO for all Console accounts to neutralize the PR:L prerequisite, and review WebLogic role assignments to ensure non-administrative users do not hold Monitor/Operator/Deployer roles that could satisfy the low-privilege requirement. If the Console is not used operationally, consider disabling it entirely via the domain configuration (Console Enabled = false), accepting the trade-off that all administration must then occur via WLST or REST management APIs.