CVE-2026-35301: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

A critical unauthenticated remote code execution vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, specifically in the administrative Console component. The flaw is reachable over the network via HTTP and requires no credentials or user interaction to exploit. Successful exploitation gives an attacker full control of the WebLogic Server instance, with impact that can extend beyond the directly targeted host to other systems in the environment. No fix versions have been published by Oracle; HarborGuard is actively tracking this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WebLogic Server Console over the network via HTTP; no physical or local access is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the attacker can begin exploitation anonymously.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and does not depend on any action by a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other variable environmental factors.

Blast Radius

• The attacker achieves full takeover of the WebLogic Server instance, gaining the ability to read all data the server can access, including application secrets, configuration files, and database credentials.
• The attacker can write or overwrite data, deploy arbitrary applications or backdoors, and modify persisted application state.
• The attacker can terminate or crash the WebLogic Server process, taking down all applications hosted on the instance.
• Because the CVSS scope is changed, a successful attacker can pivot from the compromised WebLogic host to other systems within the same environment that trust or communicate with it.