CVE-2026-35298: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)

Synopsis

A remote code execution vulnerability exists in the Core component of Oracle WebLogic Server, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An attacker with administrative credentials can reach the server over HTTP and exploit this flaw without any victim interaction, gaining full control of the WebLogic instance with effects that spill over into adjacent systems (a CVSS scope change). Successful exploitation gives the attacker complete read, write, and availability control over the server and potentially connected products. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic HTTP interface over the network; there is no local-only attack path.

• AuthenticationRequired

  A high-privileged (administrative) account is required; low-privilege or anonymous access is not sufficient to trigger this vulnerability.

• Victim interactionNot required

  No user action is needed; the attacker can complete the exploit entirely on their own without any victim participation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental factors outside the attacker's control.

Blast Radius

• The attacker achieves full takeover of the WebLogic Server instance, reading all data the server can access including credentials, application data, and runtime secrets.
• The attacker can write to or modify any data the server manages, including deployed applications, configuration files, and persisted database records reachable via the server.
• The attacker can crash or render the WebLogic Server permanently unavailable, disrupting all dependent services and workloads.
• Because the CVSS scope changes, the impact extends beyond WebLogic itself: adjacent systems that trust or share resources with the compromised server are also exposed to the same level of confidentiality, integrity, and availability loss.