A vulnerability exists in the Core component of Oracle WebLogic Server that permits an unauthenticated attacker with network access over IIOP to compromise the platform. The flaw is classified as a high‑severity flaw (CVSS 3.1 base score 9.8) and provides full confidentiality, integrity, and availability impact should the compromise succeed. The vulnerability is essentially an authentication bypass that allows an attacker to take over a running WebLogic instance, escalating to system compromise.

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected. The vulnerability specifically impacts the Core component of Oracle WebLogic Server.

The CVSS score of 9.8 indicates the exploit presents a complete compromise. EPSS score is < 1%, indicating a very low but nonzero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is network based via IIOP, and because authentication is not required the attack requires only connectivity to the vulnerable port. Successful exploitation could lead to arbitrary code execution and full control over the affected WebLogic Server.