What is the CVSS score of CVE-2026-35301?

CVE-2026-35301 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35301?

Oracle WebLogic Server (versions 12.2.1.4.0 and 14.1.1.0.0) contains a critical vulnerability (CVSS 10.0) enabling remote server takeover through the Console component without authentication.

How to fix or mitigate CVE-2026-35301?

Within 24 hours: Complete inventory of all Oracle WebLogic Server deployments with versions 12.2.1.4.0 and 14.1.1.0.0, identifying internet-facing or externally-accessible Console components. Implement emergency firewall rules restricting Console access to internal trusted networks only. Within 7 days: Deploy Web Application Firewall rules providing additional Console access controls; evaluate operational feasibility of disabling the Console component where not required. Within 30 days: Monitor Oracle security advisories for patch releases and develop an upgrade plan to patched versions, or establish a migration strategy to alternative platforms if patch timeline remains unclear.

Oracle WebLogic Server CVE-2026-35301

EUVD-2026-37427 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

HTTP-reachable Console, no auth or interaction, low complexity, full CIA takeover, and explicit scope change to adjacent middleware all match Oracle's description.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:34 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an unauthenticated network attacker to fully compromise the server with a scope change that impacts adjacent products. The CVSS 3.1 base score of 10.0 reflects the worst-case combination of network reachability, low complexity, no privileges, and full CIA impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

WebLogic Server is Oracle Fusion Middleware's Java EE application server, widely used to host enterprise Java applications and integration tiers. The vulnerable component is the WebLogic Administration Console, an HTTP-exposed management interface that has historically been the focal point for many critical WebLogic flaws (e.g., the T3/IIOP and Console deserialization lineage). Because no CWE is provided, the underlying class is not formally enumerated, but the combination of HTTP attack vector, unauthenticated access, and scope change in the Console strongly suggests an authentication or deserialization-class flaw allowing arbitrary action on the server JVM and downstream impact on integrated middleware (databases, identity stores, message buses) that share trust with the WebLogic process.

RemediationAI

Apply the patches distributed in the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html for WebLogic Server 12.2.1.4.0 and 14.1.1.0.0; exact post-patch build numbers are documented in that advisory and should be cited from there rather than guessed. As compensating controls until patching, restrict network access to the Administration Console by binding it to an internal management interface, placing it behind a VPN or jump host, and using a reverse proxy or firewall rule to deny external HTTP/HTTPS access to the /console and /consolehelp URI paths - note this breaks remote browser-based administration and may affect monitoring tooling that scrapes the Console. Where operationally feasible, disable the Administration Console entirely on production domains (Domain Configuration → General → uncheck 'Console Enabled'), accepting the trade-off that administrators must then rely on WLST or scripted deployments. Monitor HTTP access logs for unauthenticated requests to Console URIs as a detection fallback.