CVE-2026-35303: WebLogic Server Console Vulnerability – Patch & Detection Guide

Technical summary

CVE-2026-35303 is an authentication and authorization weakness (CWE-306) in the WebLogic Server Console component. The vulnerability permits a low-privileged network user to perform unauthorized actions that compromise confidentiality, integrity, and availability. The attack vector is network-based via HTTP, requires low attack complexity, and necessitates valid user credentials but no user interaction. The CVSS 3.1 score of 8.8 reflects high impact across all security properties: attackers can exfiltrate data, modify running configurations, and terminate processes or services.

Business impact

A successful exploitation of this vulnerability could result in complete operational compromise of WebLogic Server instances. Adversaries could access confidential business data, alter application behavior, deploy malicious code, or render services unavailable. For organizations relying on WebLogic for critical middleware functions—such as application serving, message brokering, or identity management—this represents a path to lateral movement within the infrastructure and potential business disruption. The requirement for authenticated access slightly reduces immediate exposure but remains critical for any user account that may be compromised or misused.

Affected systems

Oracle WebLogic Server versions 12.2.1.4.0 (12c Release 2) and 14.1.1.0.0 (14c Release 1) are confirmed vulnerable. Organizations should verify all deployed instances against these specific versions. Patch status and workarounds should be confirmed through the Oracle Security Advisory for CVE-2026-35303.

Exploitability

The vulnerability is easily exploitable by an attacker with valid network credentials and basic system access. No special tools, zero-day knowledge, or advanced techniques are required once authentication is obtained. The low attack complexity and absence of user interaction requirements mean that exploitation can be automated and scaled. However, the requirement for low-level authenticated access provides a single control point: securing user credentials and limiting network access to the WebLogic Console reduces immediate risk.

Remediation

Organizations should prioritize patching WebLogic Server instances to versions that address CVE-2026-35303. Consult Oracle's official security advisory for approved patch levels and release dates. Interim mitigations include: restricting network access to the WebLogic Console to trusted administrative networks only, implementing strong authentication controls, monitoring for suspicious console activity, and reviewing user privilege assignments to limit the blast radius if a low-privileged account is compromised.

Patch guidance

Verify the latest Oracle WebLogic Server security advisory to identify the available patched versions for your deployment. Apply patches first to non-production environments to validate compatibility with your applications and custom configurations. Schedule patching during maintenance windows to minimize disruption. For versions 12.2.1.4.0 and 14.1.1.0.0, confirm that your target patch version is documented as resolving CVE-2026-35303 before deployment.

Detection guidance

Monitor WebLogic Server logs for unusual Console access patterns, particularly from low-privileged accounts performing administrative actions. Watch for failed or suspicious authentication attempts, rapid privilege escalation attempts, or console API calls that deviate from normal baselines. Network intrusion detection systems should be tuned to flag unauthorized HTTP requests to the Console port from unexpected sources. Endpoint detection tools can flag process execution or file modification anomalies on WebLogic Server hosts that may indicate post-exploitation activity.

Why prioritize this

This vulnerability merits urgent patching due to its high CVSS score (8.8), complete impact on confidentiality, integrity, and availability, and the ease of exploitation once network credentials are obtained. Although it requires authenticated access, the low barrier to entry and high business impact make it a top target for adversaries seeking to move laterally within a compromised network or for insiders abusing legitimate credentials. Organizations should treat this as critical in their patch management queue.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects a network-accessible vulnerability with low attack complexity that requires only low-level privileges and produces complete system compromise. The score accounts for high impact on confidentiality (data exposure), integrity (unauthorized modification), and availability (service disruption). The absence of required user interaction after initial authentication and the lack of scope escalation limit the score from critical, but the overall risk remains substantial given the ease of exploitation and complete control granted to an attacker.

Frequently asked questions