EUVD-2026-37428Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Console reachable over HTTP (AV:N, PR:N) but needs admin interaction and specialized conditions (UI:R, AC:H); takeover with cross-component impact justifies S:C and C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
AnalysisAI
Server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Console component) allows a remote unauthenticated attacker who can lure an authenticated user into interacting with a crafted HTTP request to fully compromise the server with a scope change to other products. CVSS 8.3 reflects high impact tempered by high attack complexity and required user interaction; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network HTTP reachability to the WebLogic Administration Console, (2) interaction from a person other than the attacker - in practice an authenticated WebLogic operator/administrator clicking or loading attacker-controlled content while a Console session is active, and (3) the specialized circumstances implied by AC:H, meaning timing, configuration, or session state outside the attacker's direct control must align. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious page or sends a phishing link to a WebLogic administrator; when the admin - already authenticated to the WebLogic Console - visits the page, a crafted HTTP request is issued to the Console that triggers the flaw and pivots into a takeover of the WebLogic Server and connected Fusion Middleware components. Successful exploitation is gated by the admin's interaction and the specialized conditions reflected in AC:H, but yields full confidentiality, integrity, and availability impact across the trust boundary. |
| Remediation | Apply the fixes delivered in the Oracle Critical Patch Update of June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to WebLogic Server 12.2.1.4.0 and 14.1.1.0.0; exact patched build numbers are listed in the CPU patch matrix and should be sourced directly from My Oracle Support, as the input does not enumerate a discrete fixed version string. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all WebLogic Server instances running versions 12.2.1.4.0 or 14.1.1.0.0 and map Console network accessibility; implement firewall rules restricting Console access to known administrative IP ranges only; disable Console service if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Unauthenticated remote takeover in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows network a
Remote takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible via the Console component, allowing an u
Remote takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Fusion Middleware, Core component) is achievable by
Remote takeover of Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0) is possible by u
Authenticated takeover of Oracle WebLogic Server (Fusion Middleware Core component) is possible by a high-privileged att
Share
External POC / Exploit Code
Leaving vuln.today