CVE-2026-35300: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)

Synopsis

A critical unauthenticated remote code execution vulnerability affects Oracle WebLogic Server (Core component) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw is reachable over the network via TCP without any credentials or user interaction, meaning any attacker who can reach the WebLogic port can trigger it. Successful exploitation results in full takeover of the WebLogic Server instance, giving the attacker control over confidentiality, integrity, and availability. No fix versions have been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Oracle ships a remediation.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Server over the network via TCP; any system with a network path to the exposed port is in scope.

• AuthenticationNot required

  No credentials of any privilege level are needed; the vulnerability is exploitable by a completely unauthenticated attacker.

• Victim interactionNot required

  No user or administrator action is required to trigger the vulnerability; exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special race conditions, memory-layout dependencies, or environmental prerequisites.

Blast Radius

• Full remote code execution on the WebLogic Server host, giving the attacker arbitrary command execution under the server process identity.
• Reads all data accessible to the WebLogic process, including deployed application secrets, database credentials, session tokens, and customer records.
• Modifies or deletes application data, configuration files, and deployed artifacts hosted on the server.
• Crashes or indefinitely disrupts the WebLogic Server process, taking down all applications and services running on the affected instance.