What is the CVSS score of CVE-2026-35300?

CVE-2026-35300 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35300?

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to unauthenticated remote takeover (CVE-2026-35300), allowing attackers to achieve complete system…

How to fix or mitigate CVE-2026-35300?

Within 24 hours: Conduct inventory of all Oracle WebLogic Server instances; document versions, network location, and connected systems. Within 7 days: Deploy firewall rules to restrict TCP network access to the WebLogic Core component to administratively necessary hosts only; implement connection logging and alerting. Within 30 days: Continue monitoring Oracle security advisories for patch release announcement; if patch remains unavailable, develop remediation plan including system migration, upgrade to newer unaffected versions (15.2.0 or later pending patch), or infrastructure replacement.

Oracle WebLogic Server CVE-2026-35300

EUVD-2026-37426 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-16 oracle

Oracle Weblogic Server Deserialization

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes unauthenticated network TCP exploitation resulting in full server takeover, justifying AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:33 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) is possible by unauthenticated attackers with TCP network access to the Core component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and characterizes it as 'easily exploitable,' though no public exploit identified at time of analysis. The flaw is disclosed via the Oracle Critical Patch Update for June 2026 and currently shows no CISA KEV listing or EPSS data.

Technical ContextAI

Oracle WebLogic Server is a Java EE/Jakarta EE application server widely deployed for hosting enterprise Java applications, web services, and middleware integrations. The affected 'Core' subcomponent typically handles foundational server functions such as protocol handling (T3, IIOP, HTTP), serialization, and request dispatching - historically the locus of WebLogic's most severe pre-authentication RCE flaws (e.g., the Oracle deserialization lineage CVE-2015-4852, CVE-2020-2883, CVE-2023-21839). No CWE is assigned in the input, but Oracle's pattern of 'Core' takeover bugs with AV:N/AC:L/PR:N strongly suggests an unsafe deserialization or protocol-handler issue exposed over T3/IIOP. Affected CPE is cpe:2.3:a:oracle_corporation:weblogic_server with four supported branches explicitly enumerated.

RemediationAI

Apply the patch available per vendor advisory in the Oracle Critical Patch Update for June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to the exact affected branch - Oracle has not published a discrete fix version string in the input data, so administrators should consult the CPU matrix for the per-branch patch ID. Until patching, restrict network access to WebLogic management and protocol ports (notably T3/T3S on 7001/7002 and IIOP) to trusted management networks via firewall ACLs; if T3/IIOP is not required by applications, disable those protocols in the server's connection filters, accepting that any clients relying on T3-based JNDI or RMI calls will break. Place WebLogic instances behind a reverse proxy that terminates only HTTP/HTTPS to reduce the exposed protocol surface, and monitor for anomalous deserialization-style payloads on exposed listen ports.