CVE-2026-35299: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

An authentication-bypass-adjacent privilege escalation vulnerability affects the Console component of Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. The flaw is reachable over the network via HTTP and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives an attacker full control over the WebLogic Server instance, including read, write, and denial-of-service capability. No fix version has been published yet; HarborGuard tracks the upstream advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Console over the network via HTTP; no local or physical access is needed.

• AuthenticationRequired

  A low-privilege account is sufficient; any valid WebLogic user credential satisfies this requirement.

• Victim interactionNot required

  No action from another user or administrator is needed for the attack to succeed.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special environmental setup required.

Blast Radius

• A successful attacker reads all data accessible to the WebLogic Server process, including configuration files, credentials, and application data.
• The attacker can write or modify persisted application data, configurations, and deployed artifacts on the server.
• The attacker can crash or otherwise disrupt the WebLogic Server process, taking the application offline.
• Full server takeover is achievable, meaning the attacker can deploy arbitrary code or use the server as a pivot point into adjacent infrastructure.