What is the CVSS score of CVE-2026-35303?

CVE-2026-35303 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-35303?

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 contain a critical remote takeover vulnerability (CVSS 8.8) in the Console component affecting low-privilege authenticated users.

How to fix or mitigate CVE-2026-35303?

Within 24 hours: Identify and inventory all WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 instances; map business functions and dependencies for each. Within 7 days: Implement firewall rules restricting Console access to authorized administrative networks only; enable detailed logging and alerting for Console authentication attempts. Within 30 days: Monitor Oracle security advisories for patch availability; develop and test upgrade plans to non-vulnerable versions; deploy Web Application Firewall rules to detect Console-targeting attacks.

Oracle WebLogic Server CVE-2026-35303

EUVD-2026-37429 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Console is reachable over HTTP (AV:N), low complexity per vendor (AC:L), a low-privileged WebLogic account is required (PR:L), no user interaction, and the described outcome is full server takeover (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:35 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authenticated remote takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 via the Console component allows a low-privileged attacker with HTTP network access to fully compromise the server. Oracle rates the flaw CVSS 8.8 with high impact on confidentiality, integrity, and availability, and no public exploit identified at time of analysis. The advisory was published in Oracle's June 2026 Critical Patch Update, making this a priority patching item for enterprise middleware operators.

Technical ContextAI

Oracle WebLogic Server is a widely deployed Java EE application server used as the runtime for Oracle Fusion Middleware and many internal enterprise applications. The vulnerable component is the administrative Console, a web-based management interface historically targeted by multiple high-severity flaws (Java deserialization, T3/IIOP gadget chains, JNDI injection). CWE is not assigned in the input, but the combination of low complexity, low-privileged HTTP access, and full CIA takeover is consistent with the Console-based authenticated deserialization/auth-bypass class of WebLogic issues. Affected CPE is cpe:2.3:a:oracle_corporation:weblogic_server:*, with Oracle naming 12.2.1.4.0 and 14.1.1.0.0 as the supported affected versions.

RemediationAI

Apply the patch available per vendor advisory in the Oracle Critical Patch Update Advisory for June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html), which contains the WebLogic Server patches for 12.2.1.4.0 and 14.1.1.0.0 - exact fix patch IDs are listed in the CPU matrix and should be applied during the next available maintenance window. Until patched, restrict network access to the WebLogic administration Console (default /console URI on the admin port, typically 7001/7002) to a management VLAN or jump host via firewall/reverse-proxy ACLs, which breaks remote exploitation but also blocks legitimate remote admin use. Additionally, rotate and minimize WebLogic user accounts so that low-privileged operator/monitor roles do not exist on internet- or broadly-reachable instances, since the flaw needs only PR:L; the trade-off is operational friction for delegated admins.