The vulnerability is a remote control flaw within the core component of Oracle WebLogic Server. A low‑privileged attacker with network connectivity to the T3 or IIOP protocols can leverage the weakness to take over the server, thereby gaining full control of the application, its data, and the underlying operating system. The impact includes confidentiality, integrity and availability losses across the affected system.

Oracle Corporation’s WebLogic Server is affected. All listed releases are impacted: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. These versions have been identified by the CNA as susceptible to the flaw and are still in support, meaning they remain relevant targets for attackers.

The quantified severity is a CVSS 3.1 base score of 7.5, indicating a high‑risk condition. EPSS data is not available, but the flaw is not in the CISA KEV list, suggesting it is not currently exploited in the wild. The attack path requires a low‑privileged attacker to reach the vulnerable host over the network, which typically means they must be on the same internal network or have opened the T3/IIOP ports externally. Given the known vector and the potential for full server control, the risk to organizations remains high.