CVE-2026-35303 Overview
CVE-2026-35303 is a high-severity vulnerability in the Console component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.1.0.0. A low-privileged attacker with HTTP network access can exploit the issue to fully compromise WebLogic Server. Oracle classifies the issue as easily exploitable and assigns it to [CWE-306] Missing Authentication for Critical Function. Successful exploitation results in complete server takeover with high impact to confidentiality, integrity, and availability.
Critical Impact
An authenticated attacker with low privileges can take over WebLogic Server remotely over HTTP, gaining control of hosted applications and underlying middleware data.
Affected Products
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle Fusion Middleware deployments hosting the WebLogic Console component
Discovery Timeline
- 2026-06-17 - CVE-2026-35303 published to NVD
- 2026-06-18 - Last updated in NVD database
- June 2026 - Oracle releases fix in the Oracle Critical Patch Update / Security Alert
Technical Details for CVE-2026-35303
Vulnerability Analysis
The vulnerability resides in the WebLogic Server administrative Console component. Oracle's advisory states the flaw is easily exploitable over HTTP and requires only low privileges, with no user interaction. Exploitation yields takeover of WebLogic Server, meaning the attacker obtains the same level of control as the WebLogic process. The scope is unchanged, but the resulting access to hosted Java EE applications, deployed datasources, and middleware credentials makes this a high-value target. The flaw is mapped to CWE-306 (Missing Authentication for Critical Function), indicating that a sensitive Console operation can be invoked without sufficient authentication enforcement.
Root Cause
The underlying weakness is missing or improperly enforced authentication on a critical Console function. Functionality that should require administrative authentication is reachable by lower-privileged users, allowing operations that lead to full server compromise. Oracle has not published deeper internal technical details, consistent with its Critical Patch Update disclosure practice.
Attack Vector
The attack vector is network-based and uses HTTP requests to the WebLogic Console endpoint, typically exposed on the administrative port (default 7001). An attacker with any low-privileged account on the server, or access obtained through credential reuse or weak credentials, sends crafted requests to the Console to invoke privileged functionality. The Oracle advisory should be consulted for technical specifics. See the Oracle Security Alert for vendor guidance.
Detection Methods for CVE-2026-35303
Indicators of Compromise
- Unexpected HTTP requests to /console/* paths from non-administrator source addresses.
- New or modified WebLogic deployments, datasources, or startup classes that were not pushed by change management.
- Creation of unfamiliar OS-level processes spawned by the WebLogic JVM, including shells or scripting interpreters.
- Outbound network connections originating from the WebLogic host to unknown infrastructure shortly after Console activity.
Detection Strategies
- Inspect WebLogic access.log and AdminServer.log for Console requests issued by low-privileged accounts.
- Alert on privilege escalation patterns where a non-admin user touches Console endpoints normally reserved for administrators.
- Correlate Console activity with subsequent child-process creation under the WebLogic Java process.
Monitoring Recommendations
- Forward WebLogic and host telemetry to a centralized data lake for query and retention across the patch window.
- Monitor the administrative port (default 7001) for exposure beyond approved management networks.
- Track file integrity on $DOMAIN_HOME/config and deployment directories to identify unauthorized changes.
How to Mitigate CVE-2026-35303
Immediate Actions Required
- Apply the Oracle Critical Patch Update referenced in the June 2026 Oracle Security Alert to all affected WebLogic instances.
- Restrict network access to the WebLogic Console so that only trusted administrative subnets can reach the administrative port.
- Audit WebLogic user accounts and remove or rotate credentials for unused low-privileged users.
Patch Information
Oracle addressed CVE-2026-35303 in its June 2026 Critical Patch Update. Administrators running WebLogic Server 12.2.1.4.0 or 14.1.1.0.0 must install the corresponding patch bundle from My Oracle Support. The fix is cumulative with prior Critical Patch Updates, and Oracle recommends applying it without delay due to ease of exploitation.
Workarounds
- Disable the WebLogic Administration Console in production where it is not required by setting Console Enabled to false in the domain configuration.
- Place the Console behind a reverse proxy or VPN that enforces strong authentication and source IP restrictions.
- Apply network ACLs at the firewall and host level to block external access to the administrative listen port.
# Example: restrict Console access at the OS firewall (Linux, iptables)
# Allow only the management subnet to reach the WebLogic admin port
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
# Example: disable the Administration Console via WLST
# connect('weblogic','<password>','t3://adminhost:7001')
# edit()
# startEdit()
# cmo.setConsoleEnabled(false)
# save()
# activate()
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
