A vulnerability in the Oracle WebLogic Server product allows an unauthenticated attacker having network access via the T3 or IIOP protocols to compromise the server. Successful exploitation can lead to full takeover of the WebLogic Server, resulting in a loss of confidentiality, integrity, and availability for applications and data controlled by that server. The vulnerability is severe enough to grant an attacker complete control, as reflected in the CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected Oracle WebLogic Server products include version 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. These are the specific releases listed as vulnerable and should be identified and patched accordingly.

The CVSS score of 9.8 indicates critical severity. Although no EPSS score is available, the lack of a KEV listing does not reduce the urgency; the vulnerability remains exploitable from any networked location that can reach the T3 or IIOP endpoints. Attackers require no authentication and can execute actions without interacting with a user interface, making the attack path straightforward and high‑risk. The absence of an EPSS score means that typical low probability estimates are unavailable, but the high CVSS and explicit network exploitability underscore the real threat.