CVE-2026-35311: High severity Oracle WebLogic Server vulnerability
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict or disable HTTP access to the WebLogic Server instance if it is not required. Configure the server/network so WebLogic HTTP listeners are only reachable from trusted management networks or localhost.
Oracle WebLogic Server HTTP access = restricted to trusted IPs or disabled - Compensating control
Enforce network controls (firewall rules, ACLs, WAF) to block or restrict external/Internet access to WebLogic HTTP interfaces. Allow access only from specific trusted IP ranges and management networks.
- Operational
Assume potential compromise if exposed: isolate affected hosts, review logs and indicators of compromise, rotate credentials and keys used by WebLogic and related services, and rebuild or restore systems from known-good backups if compromise is detected. Monitor Oracle advisories and apply vendor security updates as soon as fixes are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35311?
The severity of CVE-2026-35311 is high, with a score of 8.8 according to the CVSS metrics.
How do I fix CVE-2026-35311?
To fix CVE-2026-35311, update your Oracle WebLogic Server to the latest patched version as recommended by Oracle.
What versions of Oracle WebLogic Server are affected by CVE-2026-35311?
The affected versions are Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0.
What type of attack can exploit CVE-2026-35311?
CVE-2026-35311 can be exploited by a low privileged attacker with network access via HTTP.
What are the potential impacts of exploiting CVE-2026-35311?
Exploiting CVE-2026-35311 can lead to a complete compromise of WebLogic Server, affecting confidentiality, integrity, and availability.