CVE-2026-35258: High severity Oracle WebLogic Server vulnerability
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all WebLogic Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the WebLogic Server Console is not required, disable the Console. If it is required, restrict HTTPS access to the Console so that only administrative/trusted IPs or networks can reach it (for example, via network ACLs or the server's administration settings).
Oracle WebLogic Server Console HTTPS console access = disabled or restricted to administrative hosts - Compensating control
Restrict network access to the WebLogic Server Console (HTTPS) using firewall rules, VPN access, or network segmentation so only trusted administrative IP addresses or subnets can reach the management interface.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35258?
The severity of CVE-2026-35258 is high with a score of 8.7.
How do I fix CVE-2026-35258?
To fix CVE-2026-35258, upgrade to the latest patched versions of Oracle WebLogic Server.
Who is affected by CVE-2026-35258?
CVE-2026-35258 affects users of Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0.
What type of access is required to exploit CVE-2026-35258?
CVE-2026-35258 can be exploited by a low privileged attacker with network access via HTTPS.
What components are involved in CVE-2026-35258?
CVE-2026-35258 involves a vulnerability in the Console component of Oracle WebLogic Server.