CVE-2026-35311: 
Oracle WebLogic Server vulnerability analysis and mitigation

CVE-2026-35311 is an Improper Access Control vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged attacker with network access via HTTP to fully compromise the server. The vulnerability was disclosed on June 17, 2026, as part of Oracle's June 2026 Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 8.8 (High) (Oracle Advisory, NVD).

The vulnerability is classified as CWE-284 (Improper Access Control) in the Core component of Oracle WebLogic Server (NVD). An attacker with low privileges and network access over HTTP can exploit this flaw without requiring user interaction, making it straightforward to leverage once valid credentials are obtained. The attack complexity is low, and no scope change is required, meaning the impact is confined to the WebLogic Server instance itself. Oracle has not publicly disclosed the specific technical root cause or exploitation mechanism beyond the risk matrix details (Oracle Advisory).

Successful exploitation results in a complete takeover of the affected WebLogic Server, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive data, modify system files and configurations, execute arbitrary code, and disrupt service availability (Oracle Advisory, NVD). Given WebLogic Server's typical role as a critical application server in enterprise environments, a successful compromise could serve as a pivot point for lateral movement within the network.

Oracle has released patches for CVE-2026-35311 as part of the June 2026 Critical Security Patch Update; administrators should apply the relevant Fusion Middleware patches for WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 immediately (Oracle Advisory). As a temporary workaround, Oracle recommends blocking HTTP network access to WebLogic Server from unauthorized users and applying network segmentation to limit exposure. Implementing the principle of least privilege for accounts with WebLogic access and monitoring server logs for suspicious authentication activity are also advised. Oracle strongly discourages treating network-level blocking as a long-term solution and urges prompt patching (Oracle Advisory).