A flaw in Oracle WebLogic Server's console component allows a low‑privileged user who can log on to the host to compromise the application. The vulnerability requires local presence, minimal authentication effort, and the cooperation of another user to trigger exploitation. When successful, the attacker can create, delete, or modify data, and gain unauthorized read or full access to any data reachable through the console. The CVSS v3.1 base score is 7.9, indicating a high impact on both confidentiality and integrity.

The affected software versions are Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0. The console component is part of the Oracle Fusion Middleware stack, so compromise may also affect other applications running in the same domain. Only the two mentioned releases contain the flaw, and no other products are listed as directly affected.

The overall risk is substantial because an attacker only needs local access and the cooperation of another user to trigger the exploit. While the EPSS score is below 1 %, the high CVSS score and the possibility of full data loss keep the severity elevated. The vulnerability is not in the CISA KEV catalog, so no pre‑published exploit kits are known, but the high confidentiality and integrity impact necessitates immediate action. The attack vector is local, requires user interaction, and can still impact additional products if the scope changes.