A flaw in Oracle WebLogic Server permits an unauthenticated attacker that can reach the server through the T3 or IIOP protocols to compromise the system. The vulnerability enables full access to any data that the server can reach, resulting in a high confidentiality breach. The weakness is an improper authentication or access‑control defect, consistent with CWE‑287 and CWE‑284.

Affected Oracle WebLogic Server products are version 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The attack may also extend to other Oracle Fusion Middleware components due to scope changes, so any environment that leverages WebLogic Server should be examined.

The CVSS score of 8.6 classifies this as a high‑risk vulnerability, and the lack of UI or authentication steps means it can be exploited by remote attackers without user interaction. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV, but the attack vector via network protocols suggests that exposure to the Internet or untrusted networks significantly increases the exploitation likelihood.