CVE-2026-35258: Oracle WebLogic Server Console Open Redirect Vulnerability – Analysis & Patch Guidance

Technical summary

This is a CWE-601 (Open Redirect) vulnerability in the WebLogic Server Console component. The attack vector is network-based over HTTPS, requiring low privilege credentials and user interaction. The vulnerability exhibits scope change, meaning exploitation can impact systems and data beyond WebLogic Server itself. With a CVSS 3.1 base score of 8.7, it carries high confidentiality and integrity impact—an attacker can read (C:H) and modify (I:H) critical data without the ability to disrupt availability. The low attack complexity (AC:L) indicates the exploitation path is straightforward once the initial conditions are met.

Business impact

Organizations running the affected WebLogic versions face risk of unauthorized data access and modification of business-critical information. Because the scope extends beyond WebLogic Server, a successful attack can cascade to compromise other integrated systems—including databases, applications, and services that rely on WebLogic for authentication or data management. The requirement for user interaction limits mass-exploitation scenarios but makes targeted campaigns against administrators particularly dangerous. Data breach, compliance violations, and operational disruption are material concerns.

Affected systems

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 are affected. These are production-grade versions deployed in enterprise environments. Older versions (prior to 14.1.2.0.0) and newer versions (after 15.1.1.0.0) require verification against Oracle's official security advisory to confirm their status. The Console component is typically accessed by administrators and operators, limiting the attacker population to those with basic network access and valid low-privilege credentials.

Exploitability

Exploitation is rated 'easily exploitable' by Oracle. The attack chain is straightforward: an attacker with low-privilege network access crafts a malicious HTTPS request or link that exploits the redirect flaw in the Console. The attacker then tricks an authorized user (administrator, operator) into clicking or following that link. Upon successful social engineering, the attacker gains access to read or modify WebLogic data and systems. The current EPSS and KEV data do not indicate active exploitation in the wild, but the combination of ease-of-exploitation and high impact makes this a priority for rapid patching.

Remediation

Oracle has released patches for both affected versions. Organizations should consult Oracle's official security advisory to identify and deploy the correct patch version for their specific WebLogic installation. Patches should be tested in a non-production environment before production deployment. Prioritize patching systems that host sensitive data or serve as authentication/authorization hubs for other applications. Interim mitigations may include network segmentation, access controls on the Console, and monitoring of Console activity for suspicious redirects or data access patterns.

Patch guidance

Obtain and review Oracle's security bulletin for CVE-2026-35258 to identify the correct patch version for WebLogic 14.1.2.0.0 and 15.1.1.0.0. Patches should be applied during maintenance windows to minimize disruption. Test patches in staging first to verify compatibility with custom applications and extensions. After patching, verify that the Console operates normally and that any integrated identity management or single sign-on services continue to function. Confirm patch application by checking version numbers and applying Oracle's patch verification tools if available.

Detection guidance

Monitor WebLogic Server logs for unusual Console access patterns, particularly failed or redirected authentication attempts and unusual URLs in HTTP referrer headers. Watch for requests to the Console that contain redirect parameters or external URLs. Implement network-level detection to flag HTTPS requests to the Console originating from unexpected sources or containing suspicious query parameters indicative of CWE-601 exploitation. Correlate Console access logs with user actions to identify potential social-engineering attempts. Consider deploying a Web Application Firewall (WAF) in front of WebLogic to detect and block redirect-based attacks.

Why prioritize this

This vulnerability warrants high priority due to its combination of ease of exploitation, broad data access impact, scope change affecting dependent systems, and the targeting of administrative interfaces. Although KEV status is currently false and no widespread exploitation is confirmed, the risk is substantial in organizations where WebLogic is central to data management or service delivery. The human-interaction requirement does not significantly lower priority given the prevalence of successful phishing and social engineering in real-world environments.

Risk score, explained

The CVSS 3.1 score of 8.7 (HIGH) reflects the high confidentiality and integrity impact (both H), the scope change (S:C), and the low barriers to exploitation (AV:N, AC:L, PR:L). The score appropriately penalizes the requirement for user interaction (UI:R), which prevents autonomous exploitation but remains a credible attack vector. The absence of availability impact (A:N) moderates the score slightly. For most organizations, the actual business risk exceeds the numerical score due to the criticality of WebLogic systems and the potential for cascading compromise.

Frequently asked questions