The vulnerability in Oracle WebLogic Server’s Web Services component allows an unauthenticated attacker with network access via HTTP to compromise the server and unauthorized access to critical data. The impact is limited to confidentiality, with no noted integrity or availability effects. The weakness appears to be an improper access control flaw that permits bypass of authentication checks.

Affected products are Oracle WebLogic Server from Oracle Corporation. Versions impacted include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Users running these versions should verify their installed release and apply vendor advisories.

This issue carries a CVSS 3.1 Base Score of 7.5, indicating significant confidentiality risk. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote HTTP traffic from an unauthenticated network source. Successful exploitation could lead to full access to all data the WebLogic Server manages without requiring credentials.