CVE-2026-35299: High severity Oracle WebLogic Server vulnerability
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the WebLogic Server HTTP interfaces to trusted IP addresses and networks using firewalls or network ACLs; block or deny inbound HTTP access from untrusted networks.
- Compensating control
Deploy or update a Web Application Firewall (WAF) or HTTP request filtering in front of the WebLogic Console to detect and block malicious HTTP requests targeting the console.
- Operational
Monitor WebLogic HTTP access and application logs, enable IDS/IPS signatures for WebLogic exploitation attempts, and isolate affected servers from the network if suspicious activity or compromise is detected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35299?
The severity of CVE-2026-35299 is high with a CVSS score of 8.8.
How do I fix CVE-2026-35299?
To fix CVE-2026-35299, apply the latest patches provided by Oracle for affected WebLogic Server versions.
What are the affected versions of CVE-2026-35299?
The affected versions for CVE-2026-35299 are Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0.
Who is most at risk for exploitation of CVE-2026-35299?
Low privileged attackers with network access via HTTP are most at risk for exploiting CVE-2026-35299.
What impact does CVE-2026-35299 have on WebLogic Server?
CVE-2026-35299 allows for high impact on confidentiality, integrity, and availability of affected WebLogic Server instances.