Introduction
An unauthenticated information disclosure flaw in Oracle WebLogic Server's Web Services component gives remote attackers a direct path to critical server data over plain HTTP, with no credentials and no user interaction required. Oracle disclosed CVE-2026-34305 in its April 2026 Critical Patch Update. It carries a CVSS 3.1 Base Score of 7.5 and affects four supported version trains of one of the most widely deployed enterprise Java application servers in production today.
Technical Information
CVE-2026-34305 targets the Web Services component within Oracle WebLogic Server, a core piece of Oracle Fusion Middleware. Its CVSS vector sets out the risk profile:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
In plain terms:
- Attack Vector: Network. The attacker reaches the vulnerable component over the network via HTTP.
- Attack Complexity: Low. No special conditions or race conditions are needed, so the exploit path is straightforward.
- Privileges Required: None. The attacker needs no authentication of any kind.
- User Interaction: None. No legitimate user has to do anything to trigger the vulnerability.
- Scope: Unchanged. The exploited component and the impacted component are the same (WebLogic Server itself).
- Confidentiality Impact: High. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.
- Integrity and Availability Impact: None. The vulnerability does not allow data modification or service disruption.
What We Know About the Attack Flow
The attacker delivers the exploit over HTTP to the Web Services component. Because the attack needs no authentication, no user interaction, and little complexity, this vulnerability is well suited to automated scanning and exploitation at scale. An attacker with network access to a WebLogic Server's HTTP listener could craft requests against the Web Services endpoint to extract sensitive data.
Oracle and the National Vulnerability Database have not disclosed the specific exploit mechanics, the exact nature of the HTTP requests that trigger the vulnerability, or any proof of concept code. No Common Weakness Enumeration (CWE) identifier has been assigned to this CVE, which limits our ability to categorize the root cause (e.g., whether this is an authentication bypass, an XML External Entity injection, a path traversal, or another class of flaw).
Comparison With a Related Vulnerability
In the same April 2026 CPU, Oracle disclosed CVE-2026-34315, another Web Services vulnerability with an identical CVSS score of 7.5, affecting the same four versions. The difference is that CVE-2026-34315 requires interaction from a person other than the attacker. CVE-2026-34305 requires none. That makes CVE-2026-34305 the higher practical priority for defenders, because it can be exploited entirely through automated, unsolicited network requests.
Patch Information
Oracle has addressed CVE-2026-34305 in its April 2026 Critical Patch Update (CPU), released on April 21, 2026. The patch is vendor-supplied and closed source, so there are no public source code diffs or commit histories to inspect. That is standard for Oracle proprietary products.
The patch targets the Web Services component of Oracle WebLogic Server and covers all four affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The fix changes how the Web Services component handles incoming requests and tightens access controls to prevent information disclosure.
To get the patch binaries, administrators must go through Oracle's distribution process:
- Open the Oracle Critical Patch Update Advisory, April 2026.
- In the Affected Products and Patch Information table, find the row for Oracle WebLogic Server.
- Click the Fusion Middleware link in the Patch Availability Document column. This opens the Fusion Middleware CPU Patch Availability Document (PAD) on My Oracle Support (MOS). The MOS Doc ID for the full list of current and previously released Fusion Middleware CPU patches is KA1182.
- In the PAD, select the applicable WebLogic Server version (e.g., 12.2.1.4, 14.1.1.0, 14.1.2.0, or 15.1.1.0) and follow the Patch Advisor to download the correct Patch Set Update (PSU) bundle.
Oracle delivers WebLogic patches as cumulative Patch Set Updates (PSUs). Each quarterly PSU rolls up all prior security fixes, so applying the April 2026 PSU also picks up the fixes from the January 2026 CPU and earlier. Administrators apply the patch with Oracle's OPatch utility against the WebLogic Server home directory.
In WebLogic Server for OCI environments, patches are not applied to existing domains automatically. They must be deployed manually.
The fix for this CVE is one of 59 new security patches for Oracle Fusion Middleware in the April 2026 CPU, and 46 of those address vulnerabilities that are remotely exploitable without authentication. Downloading the patch from My Oracle Support requires an active Oracle Support contract.
Affected Systems and Versions
The following versions of Oracle WebLogic Server are confirmed affected:
| Product Component | Affected Version | Attack Vector | Requires Authentication | Requires User Interaction | CVSS Base Score |
|---|---|---|---|---|---|
| Web Services | 12.2.1.4.0 | HTTP | No | No | 7.5 |
| Web Services | 14.1.1.0.0 | HTTP | No | No | 7.5 |
| Web Services | 14.1.2.0.0 | HTTP | No | No | 7.5 |
| Web Services | 15.1.1.0.0 | HTTP | No | No | 7.5 |
All four supported version trains share the same risk profile and exploitability metrics. Organizations should inventory their environments for these versions to find out where they are exposed. Any WebLogic Server instance that exposes the Web Services component over HTTP is potentially at risk.
Vendor Security History
Oracle handles security vulnerabilities through a standardized quarterly release cycle called Critical Patch Updates. The April 2026 CPU alone included 59 new security patches for Oracle Fusion Middleware, and 46 of them address remotely exploitable vulnerabilities that require no authentication. That volume is consistent with Oracle's historical pattern of bundling large numbers of security fixes into each quarterly release. WebLogic Server has been a recurring target in Oracle CPUs, because it is widely deployed in enterprises and has a broad attack surface.
