CVE-2026-35298 Overview
CVE-2026-35298 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows a high-privileged attacker with network access via HTTP to compromise WebLogic Server. Successful exploitation can result in full takeover of the server and impacts confidentiality, integrity, and availability. The vulnerability carries a scope change, meaning successful attacks can affect resources beyond WebLogic Server itself. Oracle classified the issue under CWE-284: Improper Access Control and addressed it in the June 2026 Critical Patch Update.
Critical Impact
Authenticated attackers with high privileges can take over WebLogic Server over the network and impact additional Oracle Fusion Middleware components through scope change.
Affected Products
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
Discovery Timeline
- 2026-06-17 - CVE-2026-35298 published to NVD
- 2026-06-18 - Last updated in NVD database
Technical Details for CVE-2026-35298
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle WebLogic Server and is categorized as Improper Access Control [CWE-284]. An attacker who already holds high privileges on the target can issue crafted HTTP requests to escalate control and take over the WebLogic Server instance. Because the vulnerability triggers a scope change, the attacker can affect resources owned by other components in the Oracle Fusion Middleware stack. The impact covers confidentiality, integrity, and availability, making post-exploitation activity broad in scope.
Root Cause
The root cause is improper enforcement of access controls within the WebLogic Server Core component. Authorization checks fail to confine an authenticated, privileged user to the resources they should be permitted to operate on. This control gap allows the attacker to invoke administrative or sensitive functionality that the access policy is intended to restrict. Oracle has not published implementation-level details beyond the June 2026 Critical Patch Update advisory.
Attack Vector
Exploitation requires network access to the WebLogic Server HTTP listener and valid high-privileged credentials. No user interaction is required. Attack complexity is low, indicating the exploit path is reliable once authentication is obtained. Common precursors to exploitation include credential theft, weak administrative passwords, or compromise of upstream identity providers that issue WebLogic credentials.
No verified proof-of-concept code is publicly available for CVE-2026-35298. See the Oracle Security Alert for vendor-supplied technical details.
Detection Methods for CVE-2026-35298
Indicators of Compromise
- Unexpected administrative HTTP requests to WebLogic Server consoles or management endpoints originating from non-administrative network segments.
- New or modified deployments, data sources, or JMX MBeans created outside of approved change windows.
- Authentication events for privileged WebLogic accounts from unusual source IPs or at atypical hours.
- Process spawns from the WebLogic Java process (java) launching shells, scripting interpreters, or network utilities.
Detection Strategies
- Correlate WebLogic access logs with identity provider logs to flag privileged sessions that bypass standard administrative workflows.
- Hunt for anomalous child processes of the WebLogic JVM, which often indicate post-exploitation command execution.
- Inspect HTTP request patterns targeting /console, /em, and other management URIs for high-privilege accounts performing rapid configuration changes.
Monitoring Recommendations
- Forward WebLogic Server, OS audit, and network flow logs to a central analytics platform with retention sufficient for incident review.
- Alert on creation of new administrative users, role grants, or changes to security realm configuration.
- Monitor outbound connections from WebLogic hosts to detect data staging or command-and-control traffic following a takeover.
How to Mitigate CVE-2026-35298
Immediate Actions Required
- Apply the Oracle June 2026 Critical Patch Update to all WebLogic Server instances running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
- Rotate credentials for all high-privileged WebLogic accounts, including WLS administrators and service accounts used by deployed applications.
- Restrict network reachability of the WebLogic administrative HTTP listeners to trusted management networks only.
- Review recent administrative activity in WebLogic logs for any indication of unauthorized configuration changes.
Patch Information
Oracle released fixes for CVE-2026-35298 as part of the June 2026 Critical Patch Update. Refer to the Oracle Security Alert for the exact patch identifiers per WebLogic Server version and Fusion Middleware bundle. Patching is the only fully effective remediation.
Workarounds
- Place WebLogic administrative endpoints behind a reverse proxy or firewall that enforces source IP allowlisting.
- Enforce multi-factor authentication on identity providers that issue credentials usable against WebLogic Server.
- Apply the principle of least privilege by reducing the number of accounts assigned the Admin or equivalent WebLogic roles.
- Enable and monitor WebLogic auditing to capture configuration changes performed by privileged users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
