CVE-2026-34305
Unauthenticated Access Vulnerability in Oracle WebLogic Web Services
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | weblogic_server | 12.2.1.4.0 |
| oracle | weblogic_server | 14.1.1.0.0 |
| oracle | weblogic_server | 14.1.2.0.0 |
| oracle | weblogic_server | 15.1.1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle WebLogic Server product, specifically in the Web Services component of Oracle Fusion Middleware. It affects several supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Such an attacker can compromise the Oracle WebLogic Server without needing any prior privileges or user interaction.
Successful exploitation can lead to unauthorized access to critical data or even complete access to all data accessible through the Oracle WebLogic Server.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access to compromise Oracle WebLogic Server, potentially resulting in unauthorized access to critical data or all accessible data on the server.
Such unauthorized access to sensitive or critical data could lead to non-compliance with data protection regulations and standards such as GDPR or HIPAA, which require the protection of personal and sensitive information.
However, specific impacts on compliance or regulatory requirements are not detailed in the provided information.
How can this vulnerability impact me? :
This vulnerability can have a significant impact as it allows an unauthenticated attacker to gain unauthorized access to sensitive or critical data hosted on the Oracle WebLogic Server.
Because the attacker does not need any privileges or user interaction, the risk of data compromise is high.
The attacker could potentially access all data accessible through the server, which could lead to data breaches, loss of confidentiality, and exposure of sensitive information.