EUVD-2026-37418Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Network vector confirmed via HTTP access; PR:H because exploitation requires high-privileged Console credentials; AC:H reflects unspecified but non-trivial exploit preconditions per Oracle description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full server takeover is possible in Oracle WebLogic Server's Console component, affecting versions 14.1.2.0.0 and 15.1.1.0.0 via HTTP over a network. Exploitation requires a high-privileged attacker and high attack complexity, limiting the realistic threat surface to scenarios where administrative credentials are already compromised or an insider threat is present. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker must hold high-privileged credentials to the WebLogic Server Console (PR:H), ruling out unauthenticated or low-privileged exploitation; (2) the attacker must have network-layer HTTP access to the Console endpoint - if the Console is bound only to a management interface or protected by a network ACL, remote exploitation is prevented; and (3) high attack complexity (AC:H) must be satisfied, implying the attacker cannot exploit this reliably on demand but must meet specific environmental or timing conditions not further detailed in available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.6 is substantially pulled down from the maximum by two key metrics: AC:H (high attack complexity) and PR:H (high privileges required). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained high-privileged WebLogic Console credentials - through credential stuffing, phishing of an admin, or lateral movement from a compromised internal host - connects to the Console over HTTP and exploits a high-complexity flaw, potentially involving a specific sequence of Console interactions or a timing-dependent condition. If the exploit conditions are satisfied, the attacker achieves code execution or equivalent control, resulting in full compromise of the WebLogic Server instance including hosted applications and data. … |
| Remediation | Apply the patches released in Oracle's Critical Patch Update for June 2026, available at https://www.oracle.com/security-alerts/cspujun2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote takeover in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows network a
Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an u
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by
Remote takeover of Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) is possible by u
Authenticated takeover of Oracle WebLogic Server (Fusion Middleware Core component) is possible by a high-privileged att
Share
External POC / Exploit Code
Leaving vuln.today