CVE-2026-35259 Oracle WebLogic Server Console RCE – CVSS 8.8 Analysis & Patch Guidance

Technical summary

The vulnerability resides in the WebLogic Server Console (a web-based administrative interface) and is classified as CWE-601, which typically indicates an open redirect or similar client-side trust boundary violation. The CVSS 3.1 vector shows network-level accessibility (AV:N), no additional complexity required (AC:L), no authentication needed (PR:N), but user interaction is mandatory (UI:R). The complete integrity and confidentiality impacts (I:H/C:H) combined with availability impact (A:H) indicate the attacker can read sensitive data, modify system configuration or data, and disrupt services. The vulnerability is confined to the Console component, suggesting it exploits a weakness in how the administrative UI validates or handles user input and redirects.

Business impact

Compromise of WebLogic Server typically translates to loss of control over critical infrastructure. WebLogic commonly hosts enterprise applications, database access layers, and integration services. A successful attack enables an adversary to steal intellectual property, modify business logic, disrupt operations, pivot to backend systems, and establish persistence. For organizations running financial, e-commerce, or healthcare applications on WebLogic, the blast radius includes customer data exposure, regulatory violations, and significant downtime costs. The requirement for user interaction narrows the immediate attack surface but does not eliminate risk—phishing campaigns and social engineering remain highly effective.

Affected systems

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 are confirmed affected. These are relatively recent versions within their respective major release lines. Organizations should verify the exact patch level of their deployed WebLogic instances immediately. The vulnerability affects the Console component specifically, meaning the administrative web interface is the entry point; however, successful exploitation grants broad server compromise. Systems where the Console is internet-exposed or accessible from untrusted networks face elevated risk.

Exploitability

The vulnerability is rated 'easily exploitable' by Oracle and requires no special tools or deep technical skill. However, it is not a pre-authentication remote code execution that works in isolation. The attacker must craft a malicious URL or web content and convince a WebLogic administrator (or authorized console user) to click it or visit a compromised page. This introduces friction: the attacker needs to identify and target console users, and those users must fall for the social engineering attempt. Once the user interaction occurs, the attack likely succeeds without additional authentication or complexity. This classification means the vulnerability is not exploitable via automated scanning or broad network spray; it requires targeted, human-directed attack.

Remediation

Oracle has issued patches for both affected versions. Organizations must apply the latest security updates from Oracle's Critical Patch Update (CPU) advisory immediately. Verify the exact patch version by consulting Oracle's official advisory (CVE-2026-35259 patch guidance). Until patches are applied, consider restricting network access to the WebLogic Console to a whitelist of known administrative IP addresses or VPNs, disabling the Console if not actively needed, and implementing multi-factor authentication for Console login to reduce the likelihood that a user will complete a phishing attack. Monitor logs for suspicious redirects or unusual Console access patterns.

Patch guidance

Apply the appropriate security patch from Oracle's CPU advisory for June 2026. Both 14.1.2 and 15.1.1 versions have patches available—verify the exact version number against Oracle's official advisory before deployment. Test patches in a non-production environment to confirm compatibility with your applications and integrations. Schedule patching during a maintenance window to avoid unplanned downtime. After patching, restart WebLogic Server instances to ensure the fix is active. Document the patch version and deployment date for audit and compliance purposes.

Detection guidance

Look for HTTP 302 or 301 redirect responses from the WebLogic Console (/console path) that point to external or unexpected domains. Examine WebLogic Server access logs for patterns consistent with phishing attempts—multiple failed login attempts followed by successful console access, or console sessions initiated from unusual IP addresses or at atypical times. Monitor for manipulation of Console configuration objects that might indicate post-exploitation activity. Implement web application firewall (WAF) rules to detect and block requests containing suspicious redirect parameters. Monitor for any outbound connections from WebLogic Server to unexpected hosts, which may indicate command-and-control communication or lateral movement attempts post-compromise.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), the complete compromise potential, and the internet accessibility of affected systems. While user interaction is required, the attacker's ability to gain full control of a critical middleware platform is severe. Organizations with WebLogic deployments should prioritize patching within days, not weeks. The impact on confidentiality, integrity, and availability is uniform and maximum, making this a business-critical vulnerability.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-level attack surface (easily reached over the internet), no authentication required, low attack complexity, but mandatory user interaction. The three maximum impacts—Confidentiality, Integrity, and Availability all marked 'High'—indicate that successful exploitation results in complete system compromise. The score is not 9.0 or higher because the attack requires user interaction, which introduces a necessary attack step the attacker cannot control. However, the unchanged scope and three critical impact categories elevate it to the HIGH band. In practice, this is a severe vulnerability for any organization running the affected versions.

Frequently asked questions