EUVD-2026-37428Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Console reachable over HTTP (AV:N, PR:N) but needs admin interaction and specialized conditions (UI:R, AC:H); takeover with cross-component impact justifies S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
AnalysisAI
Server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Console component) allows a remote unauthenticated attacker who can lure an authenticated user into interacting with a crafted HTTP request to fully compromise the server with a scope change to other products. CVSS 8.3 reflects high impact tempered by high attack complexity and required user interaction; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Oracle WebLogic Server is a Java EE/Jakarta EE application server widely deployed as middleware for Oracle Fusion Middleware stacks and enterprise applications. The flaw resides in the administrative Console component, the browser-based management interface used by operators to deploy applications, configure data sources, and manage clusters. The scope change (S:C) in the CVSS vector indicates the vulnerable Console component can affect resources beyond its own security authority - typical of Console issues that pivot through deployed applications, JNDI, or back-end services. No CWE is assigned in the input data, but the combination of UI:R, scope change, and full CIA takeover is characteristic of cross-site or request-forgery style flaws that abuse a privileged operator session against the Console.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to WebLogic Server 12.2.1.4.0 and 14.1.1.0.0; exact patched build numbers are listed in the CPU patch matrix and should be sourced directly from My Oracle Support, as the input does not enumerate a discrete fixed version string. Until patches are applied, restrict network reachability of the Administration Console to a dedicated management VLAN or jump-host (blocking external HTTP/HTTPS to /console and /em), enforce same-site cookies and strong CSRF/Referer checks at a reverse proxy in front of the Console, and instruct WebLogic administrators to use a hardened, isolated browser profile that is not used for general web browsing - these controls reduce exposure to the user-interaction component of the attack but do not eliminate the underlying flaw.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today