A remote console flaw in Oracle WebLogic Server allows a low‑privileged attacker to connect over HTTPS and create, modify or delete critical data within the server. Successful exploitation also provides unauthorized access to all data the console can reach. The vulnerability requires a separate trusted user to interact with the console, but the attacker needs only minimal privileges and a network connection to trigger the impact. These conditions grant the attacker confidentiality and integrity breaches for the affected data.

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 are affected. The CVE notes that the scope change may allow the flaw to influence other WebLogic‑based products within the same environment.

The CVSS base score of 8.7 reflects large confidentiality and integrity impacts, while the extremely low EPSS score (<1%) and the fact that the vulnerability is not listed in the CISA KEV catalog suggest that widespread exploitation is currently unlikely. The attack vector is the network over HTTPS, and it requires a privileged user or collaborator to participate, limiting its immediate impact to environments where such interaction is possible.