CVE-2026-35299: Oracle WebLogic Server Console Authentication Bypass (CVSS 8.8)

Technical summary

CVE-2026-35299 is a missing authentication/authorization flaw (CWE-306) in the WebLogic Server Console component. The vulnerability has a CVSS 3.1 score of 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network-exploitable conditions with low attack complexity and low privileges required. Successful exploitation grants the attacker complete confidentiality, integrity, and availability compromise of the targeted WebLogic instance. The flaw affects WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0.

Business impact

Complete compromise of WebLogic Server infrastructure can result in theft of sensitive data, unauthorized modification of applications and configurations, denial of service, lateral movement into connected systems, and potential business continuity disruption. Organizations dependent on WebLogic for mission-critical middleware face operational and reputational risk if exploited. The low privilege barrier to entry increases the likelihood that internal threats or compromised low-level accounts could escalate to full infrastructure control.

Affected systems

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are affected. Organizations should determine which versions are running in production and development environments. Intermediate or newer versions may not be vulnerable; consult Oracle's security advisory to confirm scope. The Console component is typically deployed in enterprise middleware stacks supporting Java EE applications.

Exploitability

The vulnerability is easily exploitable from the network with low prerequisites: an attacker needs only low-level authenticated access (e.g., a standard application user account) and network connectivity to the WebLogic Server. No user interaction or complex attack chains are required. The lack of additional access controls in the affected component means the privilege escalation can occur directly during an HTTP request, making automation straightforward.

Remediation

Apply security patches released by Oracle for versions 12.2.1.4.0 and 14.1.1.0.0 as specified in the official security advisory. If patching is delayed, restrict network access to the WebLogic Console to trusted administrative networks via firewall rules, implement strong network segmentation, and monitor for unauthorized authentication attempts. Consider disabling or isolating the Console if not actively used.

Patch guidance

Verify the exact patch version from Oracle's official security advisory for CVE-2026-35299. Test patches in a non-production environment before deploying to production. Coordinate patching with change management processes, as WebLogic patches may require application restart. Document the patch level post-deployment for compliance and future reference. Check whether your Oracle support contract covers the affected versions.

Detection guidance

Monitor WebLogic Server logs for unusual Console access patterns, particularly from low-privileged accounts accessing administrative functions or making configuration changes. Implement network-based detection for suspicious HTTP requests to the Console endpoint, especially those followed by infrastructure modifications. Track authentication events and flag privilege escalation sequences. Review access control lists on the Console component and audit recent role or permission assignments.

Why prioritize this

This vulnerability merits urgent attention due to its high CVSS score (8.8), ease of exploitation, and complete compromise potential. The low privilege requirement means existing breaches or insider threats could immediately escalate to infrastructure takeover. Organizations running versions 12.2.1.4.0 or 14.1.1.0.0 should prioritize patching or implementing network controls within days, not weeks. The authenticated nature slightly reduces critical urgency for air-gapped environments, but externally facing instances require immediate attention.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects the combination of network accessibility, low attack complexity, low privilege requirement, and complete system compromise across all three impact categories (confidentiality, integrity, availability). This score does not account for threat-specific factors such as current exploitation prevalence in the wild or business context; organizations should adjust prioritization based on exposure, asset criticality, and existing compensating controls.

Frequently asked questions