CVE-2026-35258: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

A stored or reflected cross-site scripting class vulnerability (scope-changing, high-impact) affects the Console component of Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0. An authenticated attacker with any low-privilege account can reach the Console over HTTPS and trigger the vulnerability by inducing another user to interact with a crafted request or link. Successful exploitation gives the attacker full read and write access to critical WebLogic Server data, with impact that can spill beyond the WebLogic instance itself into adjacent components. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Console over the network via HTTPS; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A low-privilege account is sufficient; no administrative or elevated credentials are needed to initiate the attack.

• Victim interactionRequired

  A separate authenticated user (other than the attacker) must interact with a crafted link or request, making social engineering a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other variable environmental factors.

Blast Radius

• Reads all data accessible to the WebLogic Server, including stored credentials, configuration secrets, and application data.
• Modifies or deletes any data accessible to the WebLogic Server, including persisted application records and server configuration.
• Because the CVSS scope is changed, impact can extend beyond the WebLogic instance itself to other components or products sharing the same host or trust boundary.