CVE-2026-35298: Critical severity Oracle WebLogic Server vulnerability
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or reconfigure WebLogic HTTP listeners so they are not reachable from untrusted networks (bind to localhost or internal management network) or disable HTTP if it is not required. If HTTP must remain available, restrict listener access to trusted IP ranges.
Oracle WebLogic Server HTTP listening interface/port = bind to internal/management interface or disable public HTTP - Compensating control
Restrict network access to Oracle WebLogic Server HTTP ports. Use firewalls, ACLs, or a WAF to allow HTTP access only from trusted management networks and block public/untrusted access to affected WebLogic instances.
- Operational
Monitor WebLogic logs and network traffic for signs of exploitation. If compromise is suspected, isolate affected hosts, perform incident response actions (containment, eradication, recovery), rotate credentials and restore systems from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35298?
The severity of CVE-2026-35298 is classified as critical with a CVSS score of 9.1.
How do I fix CVE-2026-35298?
To mitigate CVE-2026-35298, you should upgrade to the latest patched version of Oracle WebLogic Server.
What products are affected by CVE-2026-35298?
CVE-2026-35298 affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
What type of attack can exploit CVE-2026-35298?
CVE-2026-35298 can be exploited by high privileged attackers with network access via HTTP.
What components of Oracle Fusion Middleware are impacted by CVE-2026-35298?
CVE-2026-35298 impacts the Core component of the Oracle WebLogic Server within Oracle Fusion Middleware.