Overview of CVE-2026-35259: Open Redirect in the Oracle WebLogic Server Console Rated CVSS 8.8

Introduction

Oracle's June 2026 Critical Security Patch Update closes a flaw in the WebLogic Server Console that Oracle rates CVSS 8.8 and says can result in takeover of the server, even though NVD classifies the underlying weakness as an open redirect (CWE-601). For teams running WebLogic 14.1.2.0.0 or 15.1.1.0.0, the pairing of an unauthenticated network attacker with High confidentiality, integrity and availability impact makes CVE-2026-35259 worth understanding precisely, including what the public record does and does not say about how exploitation works.

Technical information

Root cause: what is public and what is not

The vulnerability sits in the Console component of Oracle WebLogic Server, part of Oracle Fusion Middleware. NVD maps it to CWE-601, URL Redirection to Untrusted Site ('Open Redirect'). MITRE defines this weakness class as an application accepting user-controlled input that identifies an external site and then using that input in a redirect. In practice, a link beginning on a legitimate, trusted host can deliver the user to an attacker-controlled page that inherits some of that trust.

WebLogic is closed source, and Oracle has not named the vulnerable servlet, parameter, or code change. Our reading of the CWE label and the CVSS vector is that a Console endpoint takes a destination URL from the request (for example a parameter used to return the user somewhere after login) and sends the browser there without validating it. That is an inference from the classification, not from Oracle's code. No vulnerable code has been published, so we do not reproduce or reconstruct any here.

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Low attack complexity and required user interaction are independent of each other. Oracle's description of the bug as easily exploitable does not remove the interaction condition. The score also measures severity only. It is not evidence that attacks are happening.

Why an open redirect rates 8.8

Open redirects on their own usually land much lower on the CVSS scale. The High impact across all three dimensions suggests the redirect can be chained with an authenticated administrator's Console session to reach server compromise. Oracle has not documented that chain.

The secondary sources also disagree on framing. SentinelOne's vulnerability database entry titles the issue an authentication bypass, while NVD's technical mapping is open redirect. None of the reviewed sources provides a reproducible bypass sequence, the vulnerable parameter, a payload, or a demonstrated transition from redirect to takeover. Invicti's listing repeats the exposure conditions without publishing an endpoint or reproduction procedure.

Probable attack flow

The following sequence combines Oracle's stated exposure conditions with SentinelOne's attack narrative. The delivery details come from the secondary source, not from an Oracle-published procedure.

1. The attacker builds a URL that points at the target organization's real WebLogic Console host over HTTPS, with a redirect destination the attacker controls.
2. The attacker delivers the link to someone with Console access. SentinelOne describes an administrator reached through phishing, chat, or another communication channel; Oracle only states that the interacting person is someone other than the attacker.
3. The victim opens the link. Because it starts on the legitimate Console host, it appears trustworthy.
4. The Console redirects the victim's browser to the external destination without validating it.
5. According to Oracle's impact rating, a successful attack can end in takeover of WebLogic Server. The intermediate steps between the redirect and takeover are not public.

We deliberately do not fill that gap with speculative credential theft, session replay, or code execution chains. Treat Oracle's takeover impact as authoritative and the missing mechanics as unknown.

Patch information

Oracle fixed CVE-2026-35259 in its June 2026 Critical Security Patch Update (CSPU), released on 16 June 2026. NVD uses Oracle's advisory as its only reference, tagged as the vendor advisory. Because WebLogic is closed source, there is no public commit, diff, or changelog. The only thing that can be confirmed publicly is which binary patches contain the fix.

Fixing builds

Oracle ships WebLogic security fixes as cumulative Patch Set Updates (PSUs), one per release line, each containing all earlier security fixes. Oracle's WebLogic for OCI patch listing and Rapid7's database both name the June 2026 PSUs:

Since PSUs are cumulative, any later PSU for the same release should also include this fix. These two PSUs also resolve the other June 2026 WebLogic issues that Tenable groups with this one in plugin 322169: CVE-2026-35292, CVE-2026-35263, CVE-2026-35258, CVE-2026-35291 and CVE-2026-46848. One install closes all of them.

What the fix likely changes

Oracle does not explain the root cause. The usual fix for a CWE-601 bug is to accept only relative paths or allowlisted destinations on the same origin, and to reject absolute or protocol-relative URLs (https://evil, //evil, and encoded variants) before redirecting. This is an inference from the CWE label, not from Oracle's code. Given the High C/I/A rating, treat the fix as critical even though it is labelled an open redirect.

Getting and verifying the patch

Patch binaries are available only through My Oracle Support. The advisory points to the Fusion Middleware patch availability document (CPU195) and Doc ID KA1182, which map patches to product combinations. Install the PSU with OPatch into the Oracle Home of every WebLogic installation in the domain, covering both Admin Server and Managed Server hosts. Then confirm the patch level:

opatch lspatches

The output should list the June 2026 (or later) PSU ID for your release. Scanners such as Tenable plugin 322169 determine patch status from this version information rather than by testing the flaw, so the PSU version string is the evidence that you are fixed.

Interim containment

Where patching takes time, SentinelOne recommends restricting Console access to a management VLAN or VPN and disabling the Console in production where it is not operationally required. Oracle notes that blocking protocols required for an attack may reduce risk, but warns that such workarounds can disrupt functionality, should be tested on nonproduction systems first, and do not correct the underlying problem. Use them as containment, not as a substitute for the PSU.

Detection methods

Public detection for CVE-2026-35259 falls into two groups: vulnerability management checks that find exposed installs, and behavioral hunting guidance for spotting abuse. No vendor or community group has published a tested Sigma, Snort/Suricata, or YARA signature for this CVE, and there are no public campaign IoCs. In practice, you find exposed servers by version and hunt for abuse with your own logging.

Finding vulnerable servers

• Tenable Nessus plugin 322169, Oracle WebLogic Server Multiple Vulnerabilities (June 2026 CSPU) (14.1.2.0.0 / 15.1.1.0.0). This is a local check that runs as an authenticated or agent scan on Windows, macOS and Unix, and requires the installed_sw/Oracle WebLogic Server KB item. It covers CVE-2026-35259 plus five other June 2026 WebLogic CVEs. It does not attempt the redirect. Tenable states that Nessus has relied only on the application's self-reported version number. A finding therefore means likely vulnerable, not exploited, and results can be wrong if a patch is applied in a way that leaves the version string unchanged. The plugin maps to IAVA 2026-A-0612 for IAVA-based reporting.
• Rapid7 InsightVM/Nexpose covers CVE-2026-35259 under the Oracle Weblogic product (added June 17, 2026). The check looks for missing Patch Set Updates on 14.1.2.0.0 and 15.1.1.0.0, so it also relies on version and patch level.
• Acunetix / Invicti Web + API includes a DAST check tagged Missing Update, Known Vulnerabilities and CWE-601. The tags suggest an unauthenticated external check that fingerprints the Console version. The public page does not say it actively tests the redirect. It is useful for finding Console instances you did not know were exposed.

A practical combination is to use the credentialed or agent check (Nessus or Rapid7) as the primary inventory of affected hosts, then use the external DAST check to identify which of those hosts expose the Console to potential attackers.

Hunting for exploitation attempts

Because the attack needs a second person to act, it leaves two kinds of evidence: the crafted request and the server's 3xx response, and whatever the administrator's session does after the click. SentinelOne's entry provides hunting ideas around both. SentinelOne notes that the entry was generated by AI and publishes no tested rule, so treat these as starting points:

• Absolute external URLs in Console redirect parameters. Search WebLogic access.log and Console audit logs for requests to Console paths carrying a full external URL in parameters such as redirect, returnTo, url or next. These names are SentinelOne's examples. The vulnerable parameter is not public, so do not restrict searches to them.
• 3xx responses from /console/* targeting external domains. Alert on successful redirect responses from Console paths whose target is outside your trusted domains. Legitimate Console redirects normally stay on the same host, which makes this signal fairly precise. It works best when a reverse proxy or WAF logs the Location response header, since WebLogic's default access log may not record it.
• WAF or proxy rules. Use regex rules to flag Console requests whose redirect target is not on an allowlist of your own domains.
• Referrer and session correlation. Look for administrator Console sessions arriving from an external referrer, followed shortly by sensitive administrative actions. Because the administrator's click is the trigger, this sequence is the strongest indicator of an attack chain.
• Signs of server takeover. Watch for new or changed deployments, data sources, startup classes or JNDI bindings appearing shortly after a suspicious redirect, and monitor file integrity in deployment directories such as $DOMAIN_HOME/servers/<server>/upload for unexpected WAR/EAR files.
• Identity anomalies. Flag administrator logins from unusual source IPs or user agents, improbable locations, and configuration changes outside working hours.

No single log source shows the full chain of crafted link, administrator click, external redirect and administrative change. Forward WebLogic Console, domain and access logs to your SIEM alongside proxy and identity data, and use scanner results to decide which servers warrant this additional monitoring.

Affected systems and versions

Vulnerable configuration conditions, per Oracle:

• The Console is reachable by the attacker over HTTPS.
• No attacker authentication is required.
• A person other than the attacker must interact for the attack to succeed.

Oracle's wording covers supported versions only. It does not establish the status of older or unsupported releases. Systems on 14.1.2.0.0 or 15.1.1.0.0 that have the June 2026 PSU (39431706 or 39431725) or a later PSU installed are fixed.

Vendor security history

Oracle describes its Software Security Assurance program as covering secure coding standards, mandatory developer security training, security leads embedded in development teams, and automated analysis and testing. Security fixes for on-premises products ship through quarterly Critical Patch Updates, with a separate Security Alert program for issuing patches or workarounds outside the regular schedule for particularly critical issues or reported active exploits.

WebLogic itself has a confirmed exploitation history. On June 1, 2026, CISA added CVE-2024-21182, a different WebLogic vulnerability, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation, requiring federal civilian agencies to remediate and urging other organizations to prioritize it. That case is a reasonable input to WebLogic patch prioritization. It does not show that CVE-2026-35259 has been exploited, that the same technique applies, or that any actor connected to the older issue is involved here. For this CVE specifically, Feedly and SentinelOne report no public proof of concept and no evidence of exploitation, and SentinelOne reports it is not in the KEV catalog.

References

• NVD: CVE-2026-35259
• CVE Record: CVE-2026-35259
• Oracle Critical Security Patch Update Advisory, June 2026
• Text Form of Oracle CSPU June 2026 Risk Matrices
• Oracle Security Blog: June 2026 Critical Security Patch Update Released
• Oracle WebLogic Server for OCI: Patches
• Rapid7 Vulnerability Database: CVE-2026-35259
• Tenable Nessus Plugin 322169
• Acunetix: WebLogic URL Redirection to Untrusted Site (CVE-2026-35259)
• Invicti Runtime SCA Finding: CVE-2026-35259
• SentinelOne Vulnerability Database: CVE-2026-35259
• Feedly: CVE-2026-35259 Exploits and Severity
• cvefeed.io: CVE-2026-35259
• NCSC NL Kwetsbaarheden: CVE-2026-35259
• MITRE CWE-601: URL Redirection to Untrusted Site (Open Redirect)
• CISA Adds One Known Exploited Vulnerability to Catalog (June 1, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Oracle WebLogic Server Technical Information
• Oracle Security Vulnerability Remediation Practices
• Oracle Software Security Assurance
• Oracle WebLogic: Determining Your Security Needs