The vulnerability in Oracle WebLogic Server’s Core component allows an attacker who can reach the server over TLS to perform unauthorized updates, inserts, deletes, or reads of a subset of data and to trigger a partial denial of service. The flaw is an authentication bypass combined with insufficient access control, enabling an unauthenticated attacker to gain write and read permissions that should be restricted. This results in loss of integrity and confidentiality of application data and a degradation of availability, as reflected by a CVSS 3.1 base score of 7.3.

Affected systems include Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all of which use the Core component of Oracle Fusion Middleware and are exposed over TLS to the network.

The CVSS score of 7.3 denotes moderate‑to‑high severity, and the EPSS score of less than 1% indicates that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog at present. Because the flaw is trivially exploitable over a standard TLS connection without prior authentication, any network‑connected adversary can directly target vulnerable instances, trying to modify data or disrupt service. Attackers can therefore use this flaw to alter critical configuration, exfiltrate data, or degrade the system’s availability.