CVE-2026-35302: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

This is a high-severity vulnerability in the Console component of Oracle WebLogic Server, affecting versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker reachable over HTTP must trick a user into taking some action (such as visiting a crafted link) to trigger the flaw; the attack complexity is rated high, meaning reliable exploitation requires specific conditions to align. Successful exploitation results in full takeover of the WebLogic Server instance, with impact extending to other products in scope due to a scope change. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Console over the network via HTTP; no local or physical access to the host is required.

• AuthenticationNot required

  No account or session credential is needed; the attacker starts from a fully unauthenticated position.

• Victim interactionRequired

  A person other than the attacker must take some action (such as clicking a crafted link or visiting a malicious page) for the attack to succeed.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must engineer specific conditions, such as particular timing, session state, or environmental factors, for the attack to be reliable.

Blast Radius

• A successful attacker gains the ability to read all data accessible to the WebLogic Server process, including configuration secrets, credentials, and application data.
• The attacker can modify persisted application state, server configuration, and deployed artifacts on the compromised instance.
• The attacker can crash or suspend the WebLogic Server service, causing an outage for dependent applications.
• Because the CVSS scope is changed, the impact can extend beyond WebLogic Server itself to other products or services running in the same environment.