CVE-2026-35311: Oracle WebLogic Server Remote Takeover via Low-Privilege Access Control Flaw

Technical summary

This vulnerability in WebLogic Server Core component stems from an improper access control mechanism (CWE-284). The flaw permits a network-based attacker with low-privilege credentials to bypass authorization controls via HTTP and achieve unauthenticated or elevated privilege execution on the server. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-accessible attack surface, low attack complexity, requirement for low-level privileges, no user interaction, and impact across confidentiality, integrity, and availability within the WebLogic scope.

Business impact

Compromise of WebLogic Server typically translates to direct access to hosted applications, databases, and middleware services. Organizations relying on affected versions face risk of data theft, unauthorized application manipulation, service disruption, and potential lateral movement within enterprise infrastructure. The ability for a low-privileged user to escalate to full server control significantly amplifies insider threat risk and supply-chain compromise scenarios.

Affected systems

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 are confirmed vulnerable. Organizations running these specific patch levels should prioritize assessment immediately. Versions outside this range require independent verification against Oracle's patch advisory to determine exposure.

Exploitability

This vulnerability is classified as easily exploitable, requiring only network access and valid low-privileged credentials. No special tools, user interaction, or complex exploitation techniques are needed. The low attack complexity and lack of user-interaction requirements mean that automated attacks or rapid weaponization are realistic threats. The presence of valid credentials (even low-privilege accounts) significantly lowers the barrier to entry.

Remediation

Organizations must apply security patches released by Oracle for the affected versions. Verify the specific patch version number against Oracle's official security advisory before deployment. In parallel, restrict network access to WebLogic administrative interfaces via firewalls and VPNs, enforce strong authentication mechanisms (including multi-factor authentication), and audit user account privileges to minimize the number of low-privileged accounts with network access to WebLogic.

Patch guidance

Consult Oracle's official security advisory for CVE-2026-35311 to obtain the correct patch version for your WebLogic deployment. Test patches in a staging environment before production rollout, particularly given the criticality of WebLogic in middleware stacks. Verify that patched versions align with your supported release roadmap and any third-party application compatibility requirements. Document the patch application date and version for compliance and incident investigation purposes.

Detection guidance

Monitor WebLogic HTTP access logs for unusual authentication patterns, particularly low-privilege users accessing sensitive administrative endpoints. Deploy network-based intrusion detection rules targeting known WebLogic exploit vectors. Review WebLogic audit logs for privilege escalation attempts and unauthorized API calls. Implement behavioral analytics to detect anomalous activities from previously low-privileged accounts post-authentication. Security scanning tools that fingerprint WebLogic versions can identify vulnerable instances within your environment.

Why prioritize this

With a CVSS score of 8.8 and easily exploitable characteristics, this vulnerability poses a critical risk to organizational security. The requirement for only low-privilege credentials—commonly held across organizations—substantially lowers attacker barriers. WebLogic's typical role as a backbone middleware platform means compromise carries enterprise-wide consequences. Patch availability and clarity around affected versions support rapid remediation action.

Risk score, explained

The 8.8 HIGH severity score reflects the combination of network-accessible attack surface (AV:N), straightforward exploitation (AC:L), low privilege requirement (PR:L), and complete impact across confidentiality, integrity, and availability. While the vulnerability does not require user interaction (UI:N) or cross-system compromise (S:U), the low-privilege entry point and full scope of control make this a particularly dangerous flaw for any organization operating the affected WebLogic versions.

Frequently asked questions