CVE-2026-35263: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)

Synopsis

This is a critical remote code execution vulnerability in Oracle WebLogic Server (Core component), affecting versions 14.1.2.0.0 and 15.1.1.0.0. It is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full takeover of the WebLogic Server instance, with impacts that spill beyond the server itself into adjacent systems (scope change). No fix version has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Server over the network via HTTP; no local or physical access is required.

• AuthenticationRequired

  Any low-privileged account is sufficient; the attacker does not need administrative or elevated credentials.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker can exploit the vulnerability entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads all data accessible to the WebLogic Server process, including credentials, session tokens, and application secrets.
• Modifies or deletes application data, configuration files, and persisted state managed by the server.
• Crashes or fully disables the WebLogic Server instance, taking down dependent applications and services.
• Impacts extend beyond the compromised server itself (scope change), meaning adjacent systems and services in the same environment are also at risk of being reached or disrupted.