CVE-2026-35291: Oracle WebLogic Server Console Privilege Escalation — Analysis & Patch Guidance

Technical summary

A privilege escalation vulnerability exists in the WebLogic Server Console (Oracle Fusion Middleware) stemming from improper authorization controls (CWE-269). The vulnerability requires network access via HTTP and can be exploited only by attackers already possessing high privileges. Attack complexity is rated as high, indicating non-trivial exploitation conditions must be satisfied. Successful compromise results in complete loss of confidentiality, integrity, and availability of the affected WebLogic Server instance.

Business impact

Compromise of a WebLogic Server through this vulnerability enables attackers to intercept sensitive application data, modify business logic or configurations, and disrupt service availability. For organizations using WebLogic as their application platform, this translates to potential exposure of customer data, fraudulent transaction capability, and extended downtime. The impact is scoped to individual server instances rather than spreading across infrastructure, limiting blast radius but requiring swift remediation where exposed systems exist.

Affected systems

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 are explicitly vulnerable. Organizations running these versions should inventory affected instances immediately, particularly those exposed to internal administrative networks or accessible from less-trusted network segments. Patched or otherwise unsupported versions outside this range should be verified against Oracle's official guidance to confirm non-applicability.

Exploitability

While the vulnerability earns a CVSS score of 6.6, the 'difficult to exploit' classification reflects real-world barriers: the attacker must already hold high-level administrative credentials, network access to the WebLogic Console must exist, and additional environmental conditions must align. These constraints significantly raise the operational difficulty compared to unauthenticated remote exploits, making this primarily a concern for insider threats or attackers who have compromised other administrative systems first. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog, suggesting limited public weaponization at present.

Remediation

Patching is the primary remediation path. Organizations should apply security updates released by Oracle for affected versions as soon as practical. Prior to patching, organizations can reduce risk by restricting network access to the WebLogic Console to only authorized administrative personnel and networks, implementing strong multi-factor authentication for administrative accounts, and monitoring administrative access logs for anomalous activity. Verify patch availability and version guidance directly from Oracle's security advisories.

Patch guidance

Consult Oracle's official security advisory for CVE-2026-35291 for exact patch version numbers and availability timelines. Patches typically address the authorization control flaw in the Console component. Test patches in a non-production environment before deploying to production systems. After patching, verify that administrative functionality remains intact and that any custom integrations with the Console continue to function correctly.

Detection guidance

Monitor WebLogic Server audit logs for unusual administrative actions, especially privilege escalation attempts or unexpected modifications to server configuration via the Console interface. Implement HTTP request logging or WAF rules to flag suspicious activity targeting the Console endpoint from unexpected source IPs or accounts. Review administrative access logs for logins by accounts that should not require WebLogic access. Consider deploying SIEM rules that correlate multiple failed administrative login attempts followed by successful access, which may indicate credential compromise.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants priority handling for any organization running the affected WebLogic versions. The requirement for high privileges limits the attacker pool but does not eliminate risk in environments where administrative account compromise is plausible. The ability to achieve full server takeover upon successful exploitation justifies treating this as higher priority than the CVSS score alone might suggest. Organizations should patch before pursuing other non-critical updates.

Risk score, explained

The CVSS 3.1 score of 6.6 reflects the combination of network accessibility (AV:N), high attack complexity due to privilege and condition requirements (AC:H), mandatory high privileges (PR:H), and the critical impact across confidentiality, integrity, and availability (C:H/I:H/A:H). While the score lands in the MEDIUM severity band, the 'complete takeover' outcome and the relatively narrow but real attack surface within organizations make this a genuine operational risk for affected deployments.

Frequently asked questions