Oracle WebLogic Server EUVD-2026-46614

The required condition is simply network reachability of the Oracle WebLogic Server HTTP interface - the CVSS vector AV:N/AC:L/PR:N/UI:N and the Authentication Bypass tag indicate no special configuration, credentials, or user interaction are needed against affected deployments of versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. What LIMITS exploitation: the target must run one of those affected versions and expose its HTTP listener to the attacker; instances that are fully internal, firewalled to trusted networks, or already patched via the July 2026 CPU are not reachable. Availability is not impacted (A:N), so the vulnerability enables data compromise rather than service disruption.

The signals are consistent and point to a genuine high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives remote, low-complexity, unauthenticated, no-interaction exploitation, and the C:H/I:H impact (with A:N) means full read and write to all server-accessible data - a 9.1 base score. The Authentication Bypass tag reinforces that no credentials are required. Tempering the urgency: no EPSS score was provided, the CVE is not in CISA KEV, and no public POC is identified, so this is not confirmed as actively exploited - the risk is currently severe-but-theoretical rather than observed in the wild. Availability impact is None, so this is a data compromise (confidentiality/integrity) rather than a denial-of-service vector. Given WebLogic's history of rapid exploit weaponization after CPU disclosure, treat the low-effort exploitation profile as the dominant factor and patch promptly, especially for internet-exposed instances.

An attacker locates an internet-facing Oracle WebLogic Server HTTP listener, sends a crafted request that bypasses authentication in the Core component, and gains unauthenticated read/write access to all server-accessible data - exfiltrating sensitive records and tampering with or deleting critical data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special complexity is needed; no public POC is currently identified, but the low exploitation barrier makes weaponization plausible once details circulate.