CVE-2026-35292: Critical severity Oracle WebLogic Server vulnerability

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Configuration

   If the Console is not required, disable remote HTTP access to the WebLogic Server Console. If it is required, restrict access to only trusted hosts (see network controls below). Apply the change via your WebLogic domain configuration or administration console per your environment's procedure.

   WebLogic Server Console console_remote_http_access = disabled or restricted
2. Compensating control

   Block or restrict HTTP access to the WebLogic Server Console at the network boundary and host firewall (e.g., allow only trusted management IP addresses/subnets). Place the Console behind a VPN or require management access over an isolated management network. Use a WAF to filter malicious HTTP requests if available.

3. Compensating control

   Isolate affected WebLogic hosts from untrusted networks until a vendor patch or official remediation is available. Implement network segmentation to limit lateral movement and exposure of other products that may be impacted.

4. Operational

   Treat potential compromise as high severity: monitor logs and indicators of compromise for signs of exploitation, perform incident response if suspicious activity is found (isolate, investigate, and remediate), and rotate all credentials/keys that could have been exposed if a takeover is suspected. Rebuild affected systems from known-good images if compromise is confirmed.

Event History

Frequently Asked Questions