CVE-2026-34315
Unauthorized Data Modification via Web Services in Oracle WebLogic
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | weblogic_server | 12.2.1.4.0 |
| oracle | weblogic_server | 14.1.1.0.0 |
| oracle | weblogic_server | 14.1.2.0.0 |
| oracle | weblogic_server | 15.1.1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle WebLogic Server product, specifically in the Web Services component. It affects several supported versions including 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. However, successful exploitation requires human interaction from someone other than the attacker.
If exploited successfully, the attacker can gain unauthorized ability to create, delete, or modify critical data or any data accessible through Oracle WebLogic Server.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized modification of critical data or any data accessible via Oracle WebLogic Server. This means an attacker could create, delete, or alter important information without permission.
Such unauthorized changes can compromise the integrity of your data, potentially disrupting business operations or leading to data corruption.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access to compromise Oracle WebLogic Server, potentially leading to unauthorized creation, deletion, or modification of critical data or all accessible data on the server.
Such unauthorized modification of critical data could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data integrity and prevention of unauthorized access or alteration of sensitive information.
However, the provided information does not explicitly state the direct effects on compliance with these regulations.