CVE-2026-35292: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

This is a complete server takeover vulnerability in the Oracle WebLogic Server Console component, affecting versions 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker reachable over HTTP can exploit this without any credentials or victim interaction, and the CVSS scope change means the impact extends beyond the WebLogic process itself to other products sharing the environment. Successful exploitation gives the attacker full control over the server, including the ability to read all data, modify any persisted state, and crash or destabilize the service. No fix versions have been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment Oracle ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Console over the network via HTTP; no physical or local access is required.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user action is required; the attacker can exploit the vulnerability directly without involving any human target.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or any other environmental factors.

Blast Radius

• The attacker gains full read access to all data processed by the WebLogic Server, including session tokens, credentials, and application data.
• The attacker can modify or delete any persisted data managed by the server, including configuration, deployed applications, and database-backed records.
• The attacker can crash or permanently destabilize the WebLogic service, causing a full denial of service for dependent applications.
• Because the CVSS scope change applies, adjacent products and services co-located in the same environment can also be compromised, not just the WebLogic process itself.