A vulnerability in the Oracle WebLogic Server product allows an unauthenticated attacker having network access via the T3 or IIOP protocols to compromise the server. Successful exploitation can lead to full takeover of the WebLogic Server, resulting in a loss of confidentiality, integrity, and availability for applications and data controlled by that server. The vulnerability is severe enough to grant an attacker complete control, as reflected in the CVSS vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected Oracle WebLogic Server products include version 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. These are the specific releases listed as vulnerable and should be identified and patched accordingly.

The CVSS score of 9.8 indicates critical severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, but the high base score reflects the severe impact. This vulnerability remains exploitable from any networked location that can reach the T3 or IIOP endpoints, and attackers require no authentication and can execute actions without interacting with a user interface, making the attack path straightforward and high‑risk. The absence of a KEV listing does not reduce the urgency; the vulnerability remains a real threat.