CVE-2026-35303: High severity Oracle WebLogic Server vulnerability
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to WebLogic Server Console HTTP endpoints: permit access only from trusted management networks/IPs using firewall rules, ACLs or a WAF; block direct Internet/untrusted network access to the Console.
- Operational
Monitor Oracle security advisories for a vendor-supplied patch or mitigation for this WebLogic Server Console vulnerability and apply the vendor patch immediately when it is released.
- Operational
If compromise is suspected or confirmed, perform incident response: isolate affected hosts, review logs for indicators of exploitation, rotate credentials and keys, and rebuild or restore systems from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35303?
The severity of CVE-2026-35303 is rated high with a score of 8.8.
How do I fix CVE-2026-35303?
To address CVE-2026-35303, users should update to the latest patched versions of Oracle WebLogic Server.
What versions are affected by CVE-2026-35303?
CVE-2026-35303 affects Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0.
What type of access is required to exploit CVE-2026-35303?
CVE-2026-35303 can be exploited by a low privileged attacker with network access via HTTP.
What impact could CVE-2026-35303 have on Oracle WebLogic Server?
CVE-2026-35303 could allow an attacker to compromise the Oracle WebLogic Server, leading to a high impact on confidentiality, integrity, and availability.