CVE-2026-35291 Overview
CVE-2026-35291 is a vulnerability in the Console component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw affects supported versions 14.1.2.0.0 and 15.1.1.0.0. An authenticated attacker with high privileges and network access via HTTP can exploit this issue to take over the WebLogic Server. The vulnerability maps to [CWE-269: Improper Privilege Management] and impacts confidentiality, integrity, and availability. Oracle addressed this issue in its June 2026 Critical Patch Update.
Critical Impact
Successful exploitation results in full takeover of the WebLogic Server, compromising hosted applications, configuration data, and any backend systems reachable from the server.
Affected Products
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
- Oracle Fusion Middleware deployments using the Console component
Discovery Timeline
- 2026-06-17 - CVE-2026-35291 published to NVD
- 2026-06-18 - Last updated in NVD database
Technical Details for CVE-2026-35291
Vulnerability Analysis
The vulnerability resides in the WebLogic Server Console, the administrative web interface used to manage domains, deployments, and runtime configuration. An attacker who already holds high privileges on the server can leverage the Console over HTTP to escalate control and seize the WebLogic instance.
Exploitation is rated as high complexity, which suggests specific server state, configuration, or timing conditions must be met for the attack to succeed. No user interaction is required, and the scope remains unchanged, meaning the impact is confined to the WebLogic Server security authority but extends to all components within it.
Because WebLogic frequently fronts business-critical Java EE applications and integrates with databases, identity providers, and message brokers, a successful takeover provides an attacker with a foothold into broader enterprise systems.
Root Cause
The issue is classified as improper privilege management ([CWE-269]) in the Console component. The Console fails to enforce sufficient restrictions on actions available to privileged users, allowing an authenticated administrator-level account to perform operations that result in full server compromise rather than the limited management actions intended by the privilege model.
Attack Vector
The attack is conducted remotely over HTTP against the Console endpoint. The attacker must first obtain high-privilege credentials, for example through credential theft, phishing of administrators, reuse of leaked secrets, or chaining with another vulnerability that grants administrative access. Once authenticated, the attacker interacts with the Console to execute operations that lead to server takeover.
No verified public proof-of-concept code is available at the time of publication. Refer to the Oracle Security Alert June 2026 for vendor technical details.
Detection Methods for CVE-2026-35291
Indicators of Compromise
- Unexpected administrative logins to the WebLogic Console from unusual source IP addresses or outside normal change windows.
- New or modified deployments, data sources, or startup classes that were not introduced through approved change management.
- Outbound network connections from the WebLogic JVM process to unknown hosts following Console activity.
- Modifications to config.xml or domain security realm settings without a corresponding administrator action.
Detection Strategies
- Monitor WebLogic access logs for authenticated requests to /console/ paths combined with administrative operations.
- Alert on privilege changes, new user creation, or role assignments within the WebLogic security realm.
- Correlate Console authentication events with subsequent process execution or file writes from the WebLogic server account.
Monitoring Recommendations
- Forward WebLogic server, audit, and access logs to a centralized SIEM for retention and correlation.
- Baseline normal administrator behavior and flag deviations in source IP, time of day, or command sequence.
- Track integrity of WebLogic configuration files and deployed artifacts using file integrity monitoring.
How to Mitigate CVE-2026-35291
Immediate Actions Required
- Apply the patches delivered in the Oracle Security Alert June 2026 to all affected WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 instances.
- Audit all accounts with administrative roles in WebLogic and remove unnecessary privileges.
- Rotate credentials for high-privilege WebLogic accounts and enforce multi-factor authentication on administrator workflows where supported.
- Review Console access logs for the past 90 days for unauthorized administrative activity.
Patch Information
Oracle released fixes for CVE-2026-35291 as part of the June 2026 Critical Patch Update. Administrators should consult the official Oracle advisory for patch identifiers, prerequisites, and post-installation steps. See the Oracle Security Alert June 2026 for the authoritative patch matrix.
Workarounds
- Restrict network access to the WebLogic Console to a dedicated management network or VPN, blocking direct internet exposure.
- Disable the WebLogic Console in production domains where it is not actively required for operations.
- Place a reverse proxy or web application firewall in front of the Console to enforce IP allow-listing and inspect administrative requests.
- Segment WebLogic hosts so that a takeover cannot directly reach databases, identity stores, or other production systems.
# Configuration example: restrict Console to internal management subnet via firewall
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
# Optionally disable the Console in production domains by editing config.xml:
# <console-enabled>false</console-enabled>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
