What’s Vulnerable › Vulnerabilities

CVE-2026-35301

Description

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Summary

CVE-2026-35301 is a critical vulnerability in the Console component of Oracle WebLogic Server that can be exploited remotely over HTTP without authentication, allowing an attacker to take over the server and potentially impact other products. It affects WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, with a CVSS score of 10.0. There is no evidence of active exploitation and it is not listed in CISA KEV, though EPSS estimates a 0.5% chance of exploitation in 30 days. Apply the relevant Oracle patches or mitigations for the affected versions as soon as possible.

CVE-2026-35301 ثغرة حرجة في مكوّن Console ضمن Oracle WebLogic Server، ويمكن استغلالها عن بُعد عبر HTTP دون مصادقة، ما يتيح للمهاجم الاستيلاء على الخادم والتأثير المحتمل على منتجات أخرى. تؤثر الثغرة في الإصدارين 12.2.1.4.0 و14.1.1.0.0 من WebLogic Server، بدرجة CVSS تبلغ 10.0. لا توجد أدلة على استغلال نشط ولم تُدرَج في CISA KEV، مع تقدير EPSS بنسبة 0.5% لاحتمال الاستغلال خلال 30 يوماً. يُنصح بتطبيق تحديثات Oracle أو إجراءات التخفيف المناسبة للإصدارات المتأثرة في أقرب وقت.

Affected products

References

Get alerted when CVE-2026-35301 or the next vulnerability affects your stack