A vulnerability in the WebLogic Server Console permits an unauthenticated attacker with network access via HTTP to take control of WebLogic Server. Successful exploitation bypasses authentication, providing the attacker with full read, write, and execute authority on the server, thereby compromising confidentiality, integrity and availability. The impact extends beyond the WebLogic Server itself, potentially affecting additional Oracle Fusion Middleware components due to the scope change indicated by the CVSS vector.

Oracle Corporation WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are affected. These render the console accessible to unauthenticated users over HTTP, exposing the system to remote compromise.

The CVSS v3.1 score of 10.0 reflects a critical severity, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers require only unauthenticated network access over HTTP; no additional privileges or user interaction are needed. The scope change in the CVSS vector suggests that exploitation can affect other products in the same environment.