Brief Summary: Oracle WebLogic Server CVE-2026-35263, a Core Improper Access Control Flaw Enabling Server Takeover

Introduction

Oracle's June 2026 Critical Security Patch Update fixed a flaw in the Core component of WebLogic Server that lets an attacker with only a low-privileged account take over the server over HTTP. Oracle rates CVE-2026-35263 at CVSS 3.1 9.9 and marks it as a scope change, so a compromised WebLogic instance can significantly affect other products that depend on it.

This post is a brief summary built from Oracle's advisory, the NVD record, and public tracker and vendor research, current as of November 4, 2026. The severity is well established, but exploitation in the wild is not publicly confirmed. The fix is a pair of quarterly WebLogic Patch Set Updates, and they need careful verification.

Technical Information

Root cause

The vulnerability is in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. It is classified as CWE-284, Improper Access Control. That classification tells us an access control decision in Core can be bypassed or is missing. It does not tell us which authorization check is faulty, which code path is involved, or what the implementation error is.

WebLogic is closed source and Oracle has not published technical details. There is no public commit, diff, or vulnerable code snippet to examine, so this post shows no code for the flaw itself.

Reading the CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• AV:N, network: the attack is delivered over HTTP.
• AC:L, low complexity: no special conditions are required beyond the stated preconditions.
• PR:L, low privileges: the attacker needs an account with basic user capabilities. This is not an unauthenticated bug. Oracle's risk matrix marks it as not remotely exploitable without authentication.
• UI:N, no user interaction: no other user has to click or approve anything.
• S:C, changed scope: the impact reaches beyond WebLogic's own security scope. Oracle states that additional products may be significantly affected, but names none.
• C:H/I:H/A:H: confidentiality, integrity, and availability are all fully compromised, consistent with server takeover.

Two caveats about the score:

• NVD lists Oracle as the source of the 9.9 and has not provided an independent assessment. It is a vendor score, not an independent NIST calculation.
• Per FIRST's CVSS v3.1 specification, Base metrics describe intrinsic severity. Exploit availability is a separate, temporal question, so a 9.9 says nothing about whether attacks are happening.

Attack flow

The disclosure defines the prerequisites and the outcome. We can describe the attack only at that level:

1. Credentials: the attacker holds a valid low-privileged account on the target WebLogic Server. The required role is not disclosed.
2. Reachability: the attacker can reach the server over HTTP.
3. Access control failure: the attacker sends HTTP requests to functionality in the Core component, where improper access control lets the low-privileged identity perform actions it should not be allowed to perform. No user interaction is involved.
4. Takeover: the result is takeover of WebLogic Server with high confidentiality, integrity, and availability impact.
5. Scope change: because of the changed scope, the compromise can significantly affect additional products that rely on or interact with the server.

The sources do not provide a vulnerable URL, request structure, payload, required account role, or exploit sequence. SentinelOne's entry labels the issue remote code execution but documents no exploit chain. None of the sources establishes deserialization, command injection, a particular management endpoint, or any other execution primitive. These details are enough to prioritize remediation, but not to build a reliable exploit test or network signature.

Exploitation status

• CISA KEV: not listed in the catalog as of November 4, 2026. Absence from KEV does not prove the flaw has never been exploited.
• Public PoC: neither SentinelOne nor Feedly documents one at its reporting snapshot.
• In the wild: neither source documents exploitation.
• Attribution and indicators: no threat actor, campaign, payload, or indicator set has been established for this CVE.

The evidence supports "not publicly confirmed." It does not support "not exploitable."

Patch Information

Oracle fixed CVE-2026-35263 in the Critical Security Patch Update Advisory for June 2026, released June 16, 2026. NVD published the CVE on June 17, 2026. These are two separate publication events for the same issue. The fix ships only as binary Patch Set Updates (PSUs) from My Oracle Support. The advisory does not link to WebLogic patch files directly. It points to the Fusion Middleware Patch Availability Document, My Oracle Support Note CPU195, which maps each affected release to its patch. Oracle states that CPUs are available to customers with valid support contracts.

Fixing patches

WebLogic security fixes come in the quarterly WLS Patch Set Update, not in individual patches for each CVE. For this CVE:

• 14.1.2.0.0: Patch 39431706, WLS PATCH SET UPDATE 14.1.2.0.260524
• 15.1.1.0.0: Patch 39431725, WLS PATCH SET UPDATE 15.1.1.0.260524

Two sources confirm this mapping:

• Rapid7's entry for CVE-2026-35263 lists PSU 39431706 for 14.1.2.0.0 and PSU 39431725 for 15.1.1.0.0.
• Oracle's WebLogic Server for OCI patch documentation lists both PSUs as the WebLogic patches in the June 2026 images (OCI release 26.2.3):

14.1.2.0.260616.01 includes 39431706 WLS PATCH SET UPDATE 14.1.2.0.260524
15.1.1.0.260616.01 includes 39431725 WLS PATCH SET UPDATE 15.1.1.0.260524

Reading the version strings

The last segment of a PSU name is a date stamp in YYMMDD form. .260524 means the fix set was built around May 24, 2026, ahead of the June 16 release. OCI image versions such as 14.1.2.0.260616.01 use the CSPU release date instead.

Verification: look for patch 39431706 or 39431725, or a later WLS PSU, in the OPatch inventory. Do not rely on the base version string, because a patched server still reports 14.1.2.0.0 or 15.1.1.0.0.

OPatch prerequisites

Oracle's OCI patch list names the OPatch version used with each PSU:

• 15.1.1.0 PSU: OPatch 13.9.6.0.1 (patch 38256237)
• 14.1.2.0 PSU: OPatch 13.9.4.2.23 (patch 28186730)

With an older OPatch, a PSU install can fail before it changes anything. Update OPatch first.

Operational notes

• Cumulative delivery: WLS PSUs include all earlier fixes. Under Oracle's usual model, any later WLS PSU for the same release should also contain this fix. The reviewed sources do not confirm a specific later PSU.
• OCI managed domains: Oracle notes that patches in a new WebLogic Server for OCI release are not applied automatically to existing domains. Instances created before the June 2026 image still need the PSU applied.
• Skipped updates: Oracle recommends reviewing previous advisories if security patches were skipped. It also recommends staying on supported releases, since Oracle does not provide fixes for versions outside support.
• No root cause detail: Oracle has not published what the patch changes, so no before-and-after comparison is possible.

Interim controls (not a fix)

Oracle lists two temporary risk reduction approaches. Neither corrects the flaw, both may break application functionality, and Oracle recommends testing them on nonproduction systems first:

• Block the network protocols required for an attack (here, HTTP access to the affected server).
• Remove unnecessary privileges or package access.

SentinelOne adds the following hardening measures:

• Restrict administrative interfaces to trusted management networks. The primary disclosure does not say administrative interfaces are the only vulnerable surface.
• Review unexpected privilege grants, remove unused low-privilege accounts, and enforce strict role-based access control.
• Enable WebLogic auditing and forward domain, access, and audit logs to a central monitoring platform.

Detection Methods

We found no detection signature specific to CVE-2026-35263:

• No Snort, Suricata, Sigma, or YARA rule.
• No confirmed IoCs such as hashes, IPs, or domains.
• No entry in the daffainfo/suricata-rules ruleset for 2026 CVEs.

With no published internals and no public PoC, there is no request pattern to write a signature against. That leaves two kinds of detection: finding vulnerable instances, which is reliable, and behavioural hunting for abuse, which is heuristic.

1. Finding vulnerable instances

Tenable's Nessus plugin 322169, Oracle WebLogic Server Multiple Vulnerabilities (June 2026 CSPU) (14.1.2.0.0 / 15.1.1.0.0), covers CVE-2026-35263 along with CVE-2026-35258, CVE-2026-35259, CVE-2026-35291, CVE-2026-35292 and CVE-2026-46848.

• Local check only: the plugin file is oracle_weblogic_server_cspu_jun_2026_CVE-2026-35292.nasl. It runs from Nessus or a Nessus Agent on Windows, macOS and Unix, and requires the KB item installed_sw/Oracle WebLogic Server. You need credentialed scans or agents. An unauthenticated network scan will not trigger it.
• Version-based: Tenable states that Nessus has not tested for the issues and relies only on the application's self-reported version number. A hit means the version is affected and the June 2026 CSPU appears missing. It does not mean the host was exploited.
• IAVA: the plugin carries IAVA 2026-A-0612, which helps teams that track compliance by IAVA.

For other inventory or CMDB tools, match hosts against the NVD configuration CPEs:

cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*

Include Fusion Middleware stacks that embed WebLogic Core.

2. Behavioural hunting

Exploitation requires a valid low-privilege account and runs over HTTP. The question for detection is therefore whether an identity without admin rights did something only an administrator should be able to do.

SentinelOne's vulnerability database entry offers CVE-specific guidance built on this idea. Treat it as a starting framework, not validated intelligence: the page states its content was AI generated and should be checked against official sources.

Candidate indicators from that entry:

• HTTP requests from authenticated low-privilege accounts to administrative or Core endpoints such as /console, /management or /wls-wsat.
• New administrative users, roles, or JNDI bindings created outside change management windows.
• Outbound connections from the WebLogic JVM (java process) to unfamiliar external hosts after authenticated HTTP sessions.
• New or modified .war/.ear deployments, or scheduled work managers, with no matching deployment ticket.

Hunting approaches:

• Correlate identity with action: join WebLogic access logs with authentication audit records to find low-privilege accounts invoking privileged Core operations. For an access control bug, this is the central correlation.
• Review server logs: check AdminServer.log and access.log for unusual HTTP verbs, parameter tampering, and unexpected 200 responses on management URIs. A successful response to an unprivileged user on an admin path deserves more attention than a failed one.
• Watch the process tree: look for shells, scripting interpreters, or LOLBins spawned by the WebLogic JVM. Because success means full server takeover, this is often the most obvious post-exploitation signal.
• Watch identity telemetry: flag accounts without admin rights that perform administrator-level actions.

3. Monitoring prerequisites

• Send WebLogic domain, access, and audit logs to a SIEM or data lake so they are retained and can be correlated with identity data. Raise WebLogic auditing as high as practical to capture authorization decisions on Core operations, which is exactly what this bug undermines.
• Baseline normal request patterns to /console and the management endpoints, then alert when authenticated low-privilege users deviate from them.
• Monitor file changes under $DOMAIN_HOME, especially the servers/<server>/upload and autodeploy directories, where a malicious deployment would land.
• Track outbound connections from WebLogic hosts and alert on unapproved destinations.

Use credentialed scanning (plugin 322169 or CPE matching) to find exposure, and behavioural correlation to find possible abuse. Expect the behavioural analytics to need tuning, because ordinary admin activity on management endpoints will trigger them. Vendor IDS or EDR content may appear if a PoC or exploitation reports emerge.

Affected Systems and Versions

• Product: Oracle WebLogic Server (Oracle Fusion Middleware), component Core.
• Affected supported versions: 14.1.2.0.0 and 15.1.1.0.0.
• Fixed by: Patch 39431706 (WLS PATCH SET UPDATE 14.1.2.0.260524) for 14.1.2.0.0, and Patch 39431725 (WLS PATCH SET UPDATE 15.1.1.0.260524) for 15.1.1.0.0. Patched servers still report the base version.
• Vulnerable configuration: an unpatched server reachable over HTTP by an attacker holding a low-privileged account.
• Embedded deployments: Fusion Middleware stacks that embed WebLogic Core should be included in inventory.
• OCI: WebLogic Server for OCI domains created from images earlier than the June 2026 release (for example, before 14.1.2.0.260616.01 or 15.1.1.0.260616.01) need the PSU applied manually.
• Unsupported releases: Oracle's advisory lists only supported releases. Oracle does not provide fixes for versions outside support, so those deployments need an upgrade path rather than a patch.

Vendor Security History

Patch program

Oracle uses quarterly Critical Patch Updates as its primary way to backport security fixes to on-premises products. It may also respond outside that schedule for particularly critical vulnerabilities or active exploits. The June 2026 advisory describes CSPUs as focused, high-priority updates that complement the cumulative quarterly program.

Related WebLogic exploitation

The following are separate issues and should not be conflated with CVE-2026-35263:

• CVE-2024-21182: CISA added this WebLogic Server vulnerability to KEV on June 1, 2026, based on evidence of active exploitation. The KEV description involves an unauthenticated attacker using T3/IIOP, unlike the low-privilege HTTP prerequisites of CVE-2026-35263.
• CVE-2026-21962: an improper access control issue in Oracle HTTP Server and the WebLogic Server Proxy Plugin, added to KEV on August 24, 2026. It is a different product surface. Track and remediate it separately rather than assuming the Core PSU covers it.

These cases show that attackers do target the WebLogic ecosystem. They do not supply an endpoint, payload, or threat actor for CVE-2026-35263, which has high severity but, publicly, no confirmed exploitation.

References

• NVD: CVE-2026-35263
• CVE.org record: CVE-2026-35263
• Oracle Critical Security Patch Update Advisory, June 2026
• Oracle Security Blog: June 2026 Critical Security Patch Update Released
• Oracle WebLogic Server for OCI: Patches
• Rapid7 Vulnerability Database: CVE-2026-35263
• Tenable Nessus Plugin 322169
• Tenable CVE page: CVE-2026-35263
• Tenable: Oracle June 2026 Critical Security Patch Update
• SentinelOne Vulnerability Database: CVE-2026-35263
• daffainfo suricata rules, 2026 CVE ruleset
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (June 1, 2026)
• CISA Known Exploited Vulnerabilities feed
• The Hacker News: Actively Exploited Oracle WebLogic Flaw
• OpenCVE: CVE-2026-35263
• Feedly: CVE-2026-35263
• GitHub Advisory Database: GHSA-2jgh-wrm7-gc7x
• Oracle WebLogic Server Technical Information
• Oracle WebLogic Server product page
• Oracle Security Vulnerability Remediation Practices
• Oracle Security Fixing Policies
• FIRST CVSS v3.1 Specification Document