CVE-2026-35259: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

This is an unauthenticated remote exploitation vulnerability in the Console component of Oracle WebLogic Server (versions 14.1.2.0.0 and 15.1.1.0.0). An attacker reachable over HTTPS needs no credentials but must trick a legitimate user into taking an action, such as clicking a crafted link, to trigger the flaw. Successful exploitation gives the attacker full control of the WebLogic Server instance, covering confidentiality, integrity, and availability. No upstream fix has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Server Console over the network via HTTPS; any internet- or intranet-exposed instance is in scope.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionRequired

  A legitimate user of the WebLogic Console must be socially engineered into performing an action, such as clicking a crafted HTTPS link, for the attack to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental prerequisites.

Blast Radius

• The attacker gains full read access to the WebLogic Server process, exposing configuration files, data sources, credentials, and any application data the server can reach.
• The attacker can write to or modify any resource the WebLogic Server process controls, including deployed application artifacts and persisted configuration.
• The attacker can crash or otherwise make the WebLogic Server instance unavailable, disrupting any applications and services it hosts.
• Combined confidentiality, integrity, and availability impact across the server constitutes a full host-level takeover as described in the CVE record.