A flaw in Oracle WebLogic Server permits a low‑privileged attacker that can reach the server through HTTP to execute arbitrary code with system‑level privileges. The vulnerability enables attackers to read, modify, or delete any data on the host and to disrupt or shut down the service. Because the flaw changes scope, compromising the server can also affect related products within the application stack.

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 on all supported platforms are affected. The weakness resides in the core component of the Fusion Middleware stack.

The CVSS v3.1 base score of 9.9 indicates a high severity rating with full confidentiality, integrity, and availability impacts. The EPSS score of less than 1% suggests that, although the vulnerability is easily exploitable, it has not yet been widely leveraged in the wild. The attack vector is a normal HTTP connection from an external network; an attacker needs only low privileges to launch the exploit, and the server can be fully compromised. The flaw is not yet listed in the CISA KEV catalog, but the severity warrants urgent action.