CVE-2026-35302: Oracle WebLogic Server Console Vulnerability (CVSS 8.3)

Technical summary

This vulnerability is classified as CWE-601 (Open Redirect or similar trust boundary violation) affecting the WebLogic Server Console component. It requires network accessibility but no prior authentication. Attack complexity is rated as high, indicating multiple conditions or user interactions must align—specifically, a legitimate user must perform an action that enables the attack vector. The scope change designation means successful exploitation extends beyond WebLogic to potentially compromise dependent systems. The vulnerability achieves a CVSS 3.1 score of 8.3 due to maximum impact across confidentiality, integrity, and availability dimensions.

Business impact

Compromise of a WebLogic Server typically means loss of control over middleware infrastructure, direct exposure of application data, and potential lateral movement into connected systems. Organizations relying on WebLogic for application hosting, service orchestration, or database connectivity face data theft, service disruption, and regulatory compliance violations. The human-interaction requirement reduces immediate risk in purely automated scenarios but increases risk in environments with active user traffic where social engineering or malicious link campaigns could trigger exploitation at scale.

Affected systems

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are confirmed affected. These are mature, production-grade releases commonly found in enterprise deployments across financial services, healthcare, and government sectors. Verify your specific patch level and configuration, as the vulnerability is confined to the Console component—air-gapped or console-disabled deployments may have reduced exposure, though this should not be relied upon as primary mitigation without vendor confirmation.

Exploitability

Exploitation is rated difficult but not impossible. The attack vector is network-based and requires no authentication, lowering the barrier to attempt. However, the high attack complexity—due to the user-interaction requirement—means successful exploitation depends on social engineering, phishing, or coincidental user behavior. No public exploit code or KEV (Known Exploited Vulnerability) status exists as of publication, reducing immediate widespread weaponization risk. Nevertheless, the high CVSS and scope change make this a credible target for sophisticated threat actors willing to invest in user-directed campaigns.

Remediation

Patch immediately to a patched version released by Oracle for both 12.2.1 and 14.1 branches. Verify patch availability in Oracle's official security advisories before deploying. In parallel, restrict network access to the WebLogic Console to trusted management networks via firewall rules, implement multi-factor authentication for console users, and disable the Console component if operationally feasible. Monitor access logs for unusual console activity. These controls do not replace patching but reduce attack surface while patches are staged.

Patch guidance

Contact Oracle directly or consult their Critical Patch Update (CPU) announcements for confirmed patch versions addressing CVE-2026-35302 for your release line. Test patches in non-production environments first, as Console changes may affect monitoring or administrative scripts. Prioritize patching version 12.2.1.4.0 and 14.1.1.0.0 systems in environments exposed to untrusted networks. Document your patch dates and versions for compliance auditing.

Detection guidance

Log and alert on Console access from unexpected source IPs or user accounts, especially failed authentication attempts followed by successful ones. Monitor for HTTP requests to the Console containing URL manipulation or redirect patterns consistent with CWE-601 exploitation. Use vulnerability scanning tools to confirm affected versions are patched. Implement network-level monitoring for lateral movement from compromised WebLogic instances to databases or other middleware services. Review audit logs for privilege escalation or configuration changes immediately after Console access events.

Why prioritize this

Despite no current KEV listing, the combination of high CVSS (8.3), scope change impact, and the prevalence of WebLogic in critical infrastructure warrants urgent prioritization. The user-interaction requirement is the primary limiting factor, but phishing campaigns targeting administrators are routine. The difficulty rating should not delay patching; it reflects complexity, not insignificance. Organizations with internet-facing or user-adjacent WebLogic deployments should patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects full compromise potential (C:H, I:H, A:H), network accessibility (AV:N), and scope change (S:C). The high attack complexity (AC:H) and user interaction requirement (UI:R) prevent a critical rating, but the breadth of impact—affecting not just WebLogic but downstream systems—and the public nature of the advisory justify treating this as a high-risk vulnerability. Real-world risk depends on your exposure (whether the Console is internet-facing, user-accessible, or locked down) and your user base's susceptibility to social engineering.

Frequently asked questions