Oracle WebLogic Server EUVD-2026-61395

Exploitation requires possession of a low-privileged WebLogic account with HTTP network access to the target server - PR:L in the CVSS vector confirms authentication is required, but high-privilege or administrative credentials are not needed, and no user interaction on a victim's part is required (UI:N). The affected component is Core, meaning no non-default feature or configuration mode needs to be enabled; a standard WebLogic HTTP listener deployment on any of the four affected version lines is sufficient. Exploitation is bounded by the need for any valid low-privilege credential and by network reachability to the HTTP port; environments that enforce strict network segmentation around WebLogic ports and maintain tight control over account provisioning materially reduce exploitation risk. Confidentiality is not impacted (C:N), so data exfiltration is not a concern - the threat is data integrity loss and service availability disruption.

The CVSS 3.1 base score of 8.1 accurately reflects a high-severity, high-impact flaw: network-accessible, low attack complexity, no user interaction, and only a low-privileged account required - even a mid-sized municipal IT team in malbork operating WebLogic-backed citizen services should treat this as urgent patching work given how broadly these supported versions are deployed. The dual High integrity and availability impact with zero confidentiality loss is an unusual profile suggesting the flaw may target a write or control plane rather than a data-read path. No EPSS data was provided in the intelligence, preventing quantitative exploitation probability assessment; this is a gap that should be monitored as NVD enrichment progresses post-CPU publication. The vulnerability is not currently listed in the CISA KEV catalog, meaning confirmed active exploitation is absent at time of analysis. Oracle's use of 'easily exploitable' in the advisory language is a formal Oracle severity qualifier that correlates with low attack complexity (AC:L) and corroborates the CVSS score. The absence of a CWE classification is a confidence limiter - without knowing the root cause class, assessing whether generic WebLogic hardening controls are sufficient as compensating measures is uncertain.

An attacker holding a low-privileged WebLogic account - such as a developer credential, an application service account, or a credential obtained through phishing - sends a specially crafted HTTP request to an exposed WebLogic managed server on the standard HTTP port. The Core component processes the request in a manner that bypasses authorization checks, enabling the attacker to overwrite, create, or delete critical server or application data, or to trigger a repeating hang condition that causes the server to become unavailable. No public exploit code has been identified, but Oracle's 'easily exploitable' designation suggests this attack path does not require deep WebLogic internals knowledge beyond obtaining a valid low-privilege credential.