CVE-2026-35303: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console)

Synopsis

An authentication-bypass-level privilege escalation vulnerability exists in the Console component of Oracle WebLogic Server (versions 12.2.1.4.0 and 14.1.1.0.0). The flaw is reachable over the network via HTTP and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full control over the WebLogic Server instance, covering confidentiality, integrity, and availability. No fix version has been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Oracle releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Console over the network via HTTP; there is no local or physical access requirement.

• AuthenticationRequired

  A low-privileged account is sufficient; the attacker does not need administrative credentials, but some valid login is required.

• Victim interactionNot required

  No user action is needed; the attacker can exploit the flaw directly without involving any other person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads all data accessible to the WebLogic Server process, including application secrets, session tokens, and any credentials stored or cached by the server.
• The attacker can write or modify persisted application data, configuration files, and deployed artifacts on the server.
• The attacker can crash or hang the WebLogic Server process, taking down hosted applications and any services that depend on them.
• Full server takeover is achievable, allowing the attacker to deploy arbitrary code or use the compromised instance as a foothold into adjacent internal systems.