Executive brief
A critical vulnerability has been identified in Oracle WebLogic Server, a platform used for building and deploying enterprise applications. An attacker can remotely take full control of the server without needing a username or password. This could lead to the theft of sensitive data, disruption of business operations, and complete compromise of the affected infrastructure.
Technical details
A vulnerability exists in the Core component of Oracle WebLogic Server (versions 12.2.1.4.0 and 14.1.2.0.0). The flaw is easily exploitable by an unauthenticated attacker with network access via TCP. Successful exploitation allows for a complete takeover of the WebLogic Server, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its high severity and lack of required privileges or user interaction. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation steps.
Affected products
- Oracle WebLogic Server 12.2.1.4.0, 14.1.2.0.0
Timeline
- 2026-07-21: disclosed: Initial disclosure by Oracle
- 2026-07-21: advisory: NVD publication date