EUVD-2026-37427Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable Console, no auth or interaction, low complexity, full CIA takeover, and explicit scope change to adjacent middleware all match Oracle's description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an unauthenticated network attacker to fully compromise the server with a scope change that impacts adjacent products. The CVSS 3.1 base score of 10.0 reflects the worst-case combination of network reachability, low complexity, no privileges, and full CIA impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
WebLogic Server is Oracle Fusion Middleware's Java EE application server, widely used to host enterprise Java applications and integration tiers. The vulnerable component is the WebLogic Administration Console, an HTTP-exposed management interface that has historically been the focal point for many critical WebLogic flaws (e.g., the T3/IIOP and Console deserialization lineage). Because no CWE is provided, the underlying class is not formally enumerated, but the combination of HTTP attack vector, unauthenticated access, and scope change in the Console strongly suggests an authentication or deserialization-class flaw allowing arbitrary action on the server JVM and downstream impact on integrated middleware (databases, identity stores, message buses) that share trust with the WebLogic process.
RemediationAI
Apply the patches distributed in the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html for WebLogic Server 12.2.1.4.0 and 14.1.1.0.0; exact post-patch build numbers are documented in that advisory and should be cited from there rather than guessed. As compensating controls until patching, restrict network access to the Administration Console by binding it to an internal management interface, placing it behind a VPN or jump host, and using a reverse proxy or firewall rule to deny external HTTP/HTTPS access to the /console and /consolehelp URI paths - note this breaks remote browser-based administration and may affect monitoring tooling that scrapes the Console. Where operationally feasible, disable the Administration Console entirely on production domains (Domain Configuration → General → uncheck 'Console Enabled'), accepting the trade-off that administrators must then rely on WLST or scripted deployments. Monitor HTTP access logs for unauthenticated requests to Console URIs as a detection fallback.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today