CVE-2026-35311: Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core)

Synopsis

An easily exploitable vulnerability in the Core component of Oracle WebLogic Server allows a network-adjacent attacker with any low-privilege account to fully compromise the server. The flaw is reachable over HTTP without requiring victim interaction, and the CVSS 3.1 score of 8.8 (High) reflects full impact across confidentiality, integrity, and availability. Successful exploitation gives the attacker complete control over the affected WebLogic instance, equivalent to a server takeover. No fix has been published by Oracle as of this writing; HarborGuard tracks the advisory for patch availability and will surface a patched-image rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WebLogic Server over the network via HTTP; no physical or local access is required, making any internet- or intranet-exposed instance a viable target.

• AuthenticationRequired

  A low-privilege account is sufficient; any valid credential grants the network foothold needed to trigger the vulnerability, but unauthenticated access alone is not enough.

• Victim interactionNot required

  No user or administrator action is needed to trigger the vulnerability; the attacker can drive the exploit entirely from their own session.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special preconditions, race conditions, or knowledge of memory layout.

Blast Radius

• A successful attacker reads all data accessible to the WebLogic Server process, including application configurations, credentials, and stored business records.
• The attacker can write to or modify any data the server can reach, including database rows, deployed application files, and configuration state.
• The attacker can crash or permanently disable the WebLogic Server process, taking down all hosted applications and causing a full service outage.
• Full server takeover means the attacker can pivot from the WebLogic host to internal network resources that the server is trusted to reach.