EUVD-2026-37393Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable Console over HTTPS with no attacker credentials but required victim interaction by an admin yields full triad takeover within the same security scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is achievable by remote unauthenticated attackers via the Console component over HTTPS, provided a victim performs an action such as clicking a malicious link. The flaw carries a CVSS 3.1 base score of 8.8 with high impact across confidentiality, integrity, and availability, but exploitation hinges on user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
WebLogic Server is Oracle's flagship Java EE/Jakarta EE application server used to host mission-critical enterprise applications, and the affected Console component is the browser-based administrative interface used by operators to manage domains, deployments, JDBC sources, and security realms. Although no CWE is published for this entry, the combination of HTTPS attack vector, required user interaction, unauthenticated network access, and unchanged scope is characteristic of a Console-side web flaw such as cross-site request forgery, reflected cross-site scripting, or a deserialization gadget triggered through an authenticated admin's browser session. The affected CPE oracle_corporation:weblogic_server covers both 14.1.2.0.0 and 15.1.1.0.0 release trains, which are Oracle's current Fusion Middleware 14c lines.
RemediationAI
Apply the Oracle Critical Patch Update referenced in the June 2026 CPU advisory at https://www.oracle.com/security-alerts/cspujun2026.html (Patch available per vendor advisory; exact post-patch build identifiers should be taken from that bulletin and applied to both 14.1.2.0.0 and 15.1.1.0.0 deployments). Until patches are applied, restrict network reachability to the Administration Console by binding it to a dedicated administration port, fronting it with an authenticated reverse proxy or VPN, and blocking external HTTPS access to /console and /em - accepting the trade-off that administrators must use the trusted network path. Additionally, train WebLogic administrators to avoid clicking unsolicited links while authenticated to the Console and consider enforcing short Console session timeouts to shrink the window in which the required user interaction can be abused.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
Share
External POC / Exploit Code
Leaving vuln.today