EUVD-2026-37428Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Console reachable over HTTP (AV:N, PR:N) but needs admin interaction and specialized conditions (UI:R, AC:H); takeover with cross-component impact justifies S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
AnalysisAI
Server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Console component) allows a remote unauthenticated attacker who can lure an authenticated user into interacting with a crafted HTTP request to fully compromise the server with a scope change to other products. CVSS 8.3 reflects high impact tempered by high attack complexity and required user interaction; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Oracle WebLogic Server is a Java EE/Jakarta EE application server widely deployed as middleware for Oracle Fusion Middleware stacks and enterprise applications. The flaw resides in the administrative Console component, the browser-based management interface used by operators to deploy applications, configure data sources, and manage clusters. The scope change (S:C) in the CVSS vector indicates the vulnerable Console component can affect resources beyond its own security authority - typical of Console issues that pivot through deployed applications, JNDI, or back-end services. No CWE is assigned in the input data, but the combination of UI:R, scope change, and full CIA takeover is characteristic of cross-site or request-forgery style flaws that abuse a privileged operator session against the Console.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to WebLogic Server 12.2.1.4.0 and 14.1.1.0.0; exact patched build numbers are listed in the CPU patch matrix and should be sourced directly from My Oracle Support, as the input does not enumerate a discrete fixed version string. Until patches are applied, restrict network reachability of the Administration Console to a dedicated management VLAN or jump-host (blocking external HTTP/HTTPS to /console and /em), enforce same-site cookies and strong CSRF/Referer checks at a reverse proxy in front of the Console, and instruct WebLogic administrators to use a hardened, isolated browser profile that is not used for general web browsing - these controls reduce exposure to the user-interaction component of the attack but do not eliminate the underlying flaw.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Share
External POC / Exploit Code
Leaving vuln.today