Executive Summary

This vulnerability exists in the Oracle WebLogic Server product, specifically in the Console component, affecting versions 14.1.2.0.0 and 15.1.1.0.0. It allows a low privileged attacker with network access via HTTPS to compromise the WebLogic Server. Successful exploitation requires human interaction from someone other than the attacker. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by WebLogic Server.

The vulnerability has a high severity with a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts. The scope of the attack can extend beyond WebLogic Server to additional products.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible by the WebLogic Server. Attackers may create, delete, or modify critical data without authorization, potentially disrupting business operations or compromising sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, Oracle recommends applying the June 2026 Critical Security Patch Update.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized creation, deletion, or modification of critical data and unauthorized access to all WebLogic Server accessible data, which can lead to significant confidentiality and integrity breaches.

Such unauthorized access and data compromise could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict protection of sensitive data and maintaining data integrity.

However, the provided information does not explicitly mention the direct effects on compliance with these standards or any regulatory guidance.

Useful 0 Not Useful 0