What is the CVSS score of CVE-2026-46848?

CVE-2026-46848 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-46848?

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 contain a privilege escalation vulnerability (CVSS 7.9) in the Console component that allows authenticated local users to compromise data…

How to fix or mitigate CVE-2026-46848?

24 hours: Identify all WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 instances; audit and restrict unnecessary local user accounts on hosting systems. 7 days: Implement role-based access controls limiting WebLogic Console access to essential personnel; enable detailed audit logging of console activities and local user interactions. 30 days: Establish communication with Oracle Support regarding patch timeline; develop and test upgrade path to patched versions; deploy enhanced monitoring for exploitation attempts.

Oracle WebLogic Server CVE-2026-46848

EUVD-2026-37341 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Weblogic Server

7.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

7.9 HIGH

Local logon required (AV:L, PR:L), victim admin must interact in Console (UI:R), and impact crosses to other products with high C/I but no availability loss (S:C, A:N).

3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:47 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where WebLogic Server executes to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all WebLogic Server accessible data. CVSS 3.1 Base Score 7.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege escalation and data tampering in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows a low-privileged local user to compromise confidentiality and integrity of all WebLogic-accessible data when a separate user is tricked into interacting with attacker-supplied content. The scope-changed nature means impact extends beyond WebLogic to additional products in the environment. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

WebLogic Server is Oracle Fusion Middleware's flagship Java EE/Jakarta EE application server widely deployed for hosting enterprise web applications, SOA, and identity workloads. The flaw resides in the administrative Console component - a web-based management interface exposed to operators and administrators - and exhibits a scope change per CVSS, meaning the vulnerable component (Console) can affect resources managed by a different security authority (downstream applications, data stores, or integrated middleware). CWE is not assigned, but the combination of UI:R, PR:L, scope change, and Console exposure points to a Console-side issue (likely stored content injection, CSRF-like coercion, or input handling abuse) where a privileged victim's browser action authorizes attacker-influenced operations. CPE coverage applies to Oracle WebLogic Server across the 14.1.2.0.0 and 15.1.1.0.0 release lines.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html); exact patched build numbers are released as part of the CPU bundle for WebLogic 14.1.2.0.0 and 15.1.1.0.0 and should be pulled from the CPU patch matrix rather than guessed. Until patched, restrict network reachability of the WebLogic Administration Console to a dedicated management VLAN or jump host (trade-off: blocks legitimate remote admin and may require VPN/Bastion changes), enforce least-privilege on WebLogic admin roles so 'low privileged' Console accounts cannot reach the affected Console functionality, and require administrators to use a hardened, dedicated browser profile to reduce the UI:R coercion surface (trade-off: workflow friction). Monitor Console audit logs for unexpected configuration or deployment changes initiated through legitimate admin sessions.