CVE-2026-46848: High severity Oracle WebLogic Server vulnerability
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where WebLogic Server executes to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all WebLogic Server accessible data. CVSS 3.1 Base Score 7.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the WebLogic Server Console component: block or limit access to the Console to trusted management IPs via firewall rules or network ACLs; only allow Console access from the management network.
- Compensating control
Restrict interactive/logon access on hosts where WebLogic Server executes: remove or disable unnecessary local user accounts, restrict which accounts may log on interactively, and apply host-level access controls to prevent low-privileged users from logging on to those systems.
- Operational
Inventory WebLogic Server installations in your environment and identify any instances running the affected supported versions: 14.1.2.0.0 and 15.1.1.0.0.
- Operational
Audit WebLogic Server Console and server logs for signs of unauthorized creation, deletion, or modification of data (review Console audit logs, server logs, and application logs). If suspicious activity is found, isolate affected servers for incident response.
- Operational
If compromise is suspected or confirmed, rotate credentials and secrets used by WebLogic Server and related services, and restore affected data/services from known-good backups as part of incident response.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46848?
The severity of CVE-2026-46848 is rated as high with a score of 7.9.
How do I fix CVE-2026-46848?
To fix CVE-2026-46848, ensure that you apply the latest security patches provided by Oracle for affected versions of WebLogic Server.
Which versions of WebLogic Server are affected by CVE-2026-46848?
CVE-2026-46848 affects WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0.
What are the attack vector and impact of CVE-2026-46848?
CVE-2026-46848 has an attack vector of low privilege with potential for compromise of confidentiality and integrity.
Can CVE-2026-46848 be exploited remotely?
CVE-2026-46848 requires an attacker to have logon access to the infrastructure where WebLogic Server runs, making remote exploitation unlikely.