EUVD-2026-46891
GHSA-xvqh-pg75-hr4f
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Console is network-reachable over HTTP (AV:N/AC:L) but exploitation demands high-privilege admin access (PR:H); no user interaction, and full server takeover yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires high-privileged authenticated access to the Oracle WebLogic Server administration Console (CVSS PR:H) and network HTTP/HTTPS reachability to that Console component; it targets supported versions 14.1.2.0.0 and 15.1.1.0.0 only. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity attack that nonetheless requires HIGH privileges (PR:H) and no user interaction - the high-privilege requirement is the principal factor holding the score to 7.2 rather than critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds high-privileged WebLogic credentials - for example a lower-trust operator, or an adversary who has phished or reused an administrator account - sends crafted HTTP requests to the WebLogic administration Console. Because attack complexity is low and no user interaction is needed, the request abuses the Console function to gain full control of the server. … |
| Remediation | Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 - this is Patch available per vendor advisory; the input does not specify an exact discrete fix build, so identify the precise patch number for your version from the Oracle CPU matrix rather than inventing one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Oracle WebLogic Server instances running versions 14.1.2.0.0 or 15.1.1.0.0 and immediately restrict network access to the administration console to only trusted administrative systems, implementing firewall rules and network segmentation as needed; enable detailed logging of all administration console authentication attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today