EUVD-2026-37425Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Console reachable over HTTP (AV:N), no special timing or config (AC:L), any authenticated WebLogic role suffices (PR:L), no user interaction, and full server takeover yields C:H/I:H/A:H within the JVM scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Authenticated takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is achievable through the administrative Console component, where a low-privileged HTTP-authenticated attacker can fully compromise confidentiality, integrity, and availability of the server. Oracle reports the issue as easily exploitable and rates it CVSS 8.8, though no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the WebLogic administrative Console over HTTP or HTTPS - typically port 7001 or 7002 on the AdminServer, and (2) valid credentials for any WebLogic account with at least a low-privilege role such as Monitor, Operator, or Deployer (PR:L); no user interaction and no elevated administrator role is needed, and the attack works against default configurations of the affected 12.2.1.4.0 and 14.1.1.0.0 versions where the Console is enabled (the default). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H translates to a high-severity, easily exploitable, low-privilege network attack with full triad impact - a realistic priority once a working exploit appears, particularly because WebLogic Consoles are frequently reachable from internal networks and sometimes inadvertently exposed to the internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained any low-privileged WebLogic account - for example through credential stuffing against an exposed Console, a phished operator user, or a default account left from a lab deployment - authenticates to the Console over HTTP/HTTPS and issues a crafted request to a vulnerable Console endpoint to escalate to full server takeover, deploying a malicious WAR or executing arbitrary commands as the WebLogic process user. From that foothold the attacker pivots to backend databases, JMS queues, and integrated Fusion Middleware components hosted by the domain. … |
| Remediation | Apply the patch available per vendor advisory by installing the June 2026 Oracle Critical Patch Update for WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; exact fix patch numbers are listed in the CPU matrix and should be applied to each managed server in the domain followed by a rolling restart. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 HOURS: Audit all Oracle WebLogic Server installations to identify systems running versions 12.2.1.4.0 or 14.1.1.0.0; immediately restrict WebLogic Console network access to administrative networks only and inventory all Console users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote takeover in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows network a
Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an u
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by
Remote takeover of Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) is possible by u
Authenticated takeover of Oracle WebLogic Server (Fusion Middleware Core component) is possible by a high-privileged att
Share
External POC / Exploit Code
Leaving vuln.today