External risk intelligence

Oracle WebLogic Server Console Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-35292

A critical vulnerability exists in Oracle WebLogic Server's Console, allowing unauthenticated network attackers to compromise the server and potentially impact other products. The issue enables attackers to achieve complete takeover of the WebLogic Server.

Missing Authentication

Halo Surface Signal

Very likely · external exposure

5Halo Surface Signal

The vulnerability affects the WebLogic Server Console, which is a management interface. Such interfaces are frequently exposed to the network, and the vulnerability specifically allows for unauthenticated access via HTTP, indicating a service that is designed or commonly positioned to be reachable over a network, including potential exposure to the public internet in many standard deployments.

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle's WebLogic Server, specifically within its Console component. This issue is easily exploitable by an unauthenticated attacker with network access and could lead to a complete takeover of the server, potentially impacting other connected products.

  • Attackers can take over WebLogic Servers.
  • Understand potential impact on connected systems.
  • Confirm relevance and confirm any exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access can target the WebLogic Server Console, a management interface accessible via HTTP. Exploiting this vulnerability can lead to a complete takeover of the WebLogic Server, potentially impacting other connected products.

  • Unauthenticated network access is required.
  • The WebLogic Server Console is the trigger point.
  • Risk includes full server takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise WebLogic Server, potentially impacting other connected products. This could lead to a complete takeover of the WebLogic Server.

  • WebLogic Server.
  • Network access via HTTP.
  • Server takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical WebLogic Server vulnerability. The first practical step is to identify all instances of WebLogic Server, determine their network reachability and business criticality, and then locate the accountable owner for each instance to plan a risk-based remediation strategy.

  • Application and infrastructure owners should lead.
  • Verify network exposure and business impact.
  • Coordinate vendor engagement and planned remediation.

Supplementary metadata

PCI scan relevance

Yes

CVE-2026-35292 — Halo PCI Relevance: Yes. Under typical PCI ASV external scan criteria, this issue may be flagged for scan prioritization.

This critical vulnerability in Oracle WebLogic Server allows unauthenticated network attackers to take over the server. The wide impact and critical severity make it a PCI concern.

Scan-prioritization guidance only—not a PCI DSS certification or ASV attestation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server and its Console component?

Oracle WebLogic Server is an enterprise-grade application server used to host and deploy Java-based business applications. It provides the infrastructure to manage complex middleware environments. The Console component is a built-in web-based management interface that administrators use to configure, monitor, and maintain the server and its deployed services.

What does CWE-306 mean for CVE-2026-35292?

CWE-306 refers to 'Missing Authentication for Critical Function.' In the context of this vulnerability, it means the WebLogic Server Console fails to verify the identity of a user before allowing them to perform sensitive management operations. Because authentication is bypassed, an attacker can interact with the interface as if they were a legitimate administrator, leading to full control over the server.

How is this WebLogic vulnerability triggered?

An attacker triggers this bug by sending specially crafted HTTP requests to the WebLogic Server Console over the network. Because the system lacks proper authentication checks, it processes these requests without requiring login credentials. Note that local access is not required; however, the vulnerability cannot be triggered if the WebLogic Console interface is entirely blocked from network traffic or restricted to trusted internal-only connections.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-relevance threat because the WebLogic Console is a management interface often reachable over a network. While many deployments are internal, these interfaces are frequently exposed, increasing the likelihood that an attacker could reach the console via HTTP. If your instance is reachable via a network path that touches the public internet or untrusted segments, the risk is significantly higher.

What should I do if I run WebLogic Server?

Start by identifying all instances of WebLogic Server within your environment and mapping their network accessibility. Prioritize instances that are reachable from outside your protected internal network. Once identified, document the business role of each server and coordinate with your infrastructure teams to verify your current version status against official vendor security guidance to begin remediation planning.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished