What is the CVSS score of EUVD-2026-37437?

EUVD-2026-37437 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by EUVD-2026-37437?

A high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 enables any authenticated user to remotely execute code and gain complete server control, putting all hosted…

How to fix or mitigate EUVD-2026-37437?

Within 24 hours: Inventory all systems running WebLogic 12.2.1.4.0 or 14.1.2.0.0; check Oracle security advisories for patch availability; assess network exposure of affected servers. Within 7 days: Implement firewall rules restricting network access to WebLogic servers; enforce multi-factor authentication for all administrative access; increase monitoring of authentication logs. Within 30 days: Upgrade WebLogic to patched versions when Oracle releases them, or migrate to Oracle WebLogic Server 21c; establish incident response protocols.

Oracle WebLogic Server EUVD-2026-37437

| CVE-2026-35311 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Weblogic Server Authentication Bypass

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

HTTP-reachable with no user interaction and low complexity; Oracle states a low-privileged account is required (PR:L), and successful exploit yields full server takeover (C:H/I:H/A:H, scope unchanged).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:39 vuln.today

DescriptionCVE.org

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Authenticated remote code execution in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP access to fully take over the server, per Oracle's June 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects full confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

WebLogic Server is Oracle Fusion Middleware's Java EE/Jakarta EE application server used to host enterprise web applications, EJBs, JMS, and SOAP/REST services, frequently exposed over HTTP/T3/IIOP on ports 7001/7002. The flaw resides in the Core component, which historically encompasses request dispatch, deserialization, JNDI lookups, and authentication plumbing - areas that have produced numerous unsafe Java deserialization and IIOP/T3 protocol issues (CWE-502 class) leading to RCE. Oracle does not publish a CWE for this entry, but the 'takeover' impact combined with low-privilege HTTP-only access strongly suggests a server-side request handling or deserialization weakness rather than a pure information disclosure issue despite the assigned tag.

RemediationAI

Patch available per vendor advisory: apply the Oracle Critical Patch Update of June 2026 for WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 as documented at https://www.oracle.com/security-alerts/cspujun2026.html; Oracle did not publish a discrete fixed build number in the provided data, so consult the CPU patch availability matrix for the exact OPatch bundle for your platform. Until patching is complete, restrict HTTP access to the WebLogic management and application listen ports (typically 7001/7002) to trusted networks via firewall or reverse proxy ACLs, remove or rotate any low-privilege application/operator accounts that are not strictly required (since PR:L is the exploitation prerequisite), and ensure the T3/T3s and IIOP protocols are filtered via the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) - note this can break legitimate clustering or remote EJB clients and should be tested. Increase monitoring on WebLogic access logs and JVM child process spawns to detect post-exploitation activity.