Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

published 2020-04-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-22676

cvss: 9.8; version 3.0, CNA
cisa kev: Exploited; added 2025-01-07
epss: 94.6%; EPSS 94.6% chance of exploitation in 30 days, percentile 99.8%
public exploits: 2; Metasploit, plus a Nuclei check

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-261-05 updated 2025-08-26 cvss 9.8

Remote Code Execution Vulnerability in Hitachi Energy Service Suite Product

Hitachi Energy Service Suite vers:/<=9.6.0.4_EP4
affected: fixed in 9.8.2, mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

2020-04-15 Published
2020-04-30 First public exploit (Metasploit exploit/multi/misc/weblogic_deserialize_badattr_extcomp)
2025-01-07 Added to CISA KEV
2025-01-11 CISA SSVC: exploitation active
2025-01-28 CISA patch deadline

Known exploited

Added: 22 mo ago (2025-01-07)
Patch by: 2025-01-28 (21 mo ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product: Oracle, WebLogic Server
CISA name: Oracle WebLogic Server Unspecified Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 21 mo ago (2025-01-11)

Exploit prediction

94.58% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/http/oracle_access_manager_rce_cve_2021_35587 Oracle Access Manager unauthenticated Remote Code Execution metasploit exploit, excellent rank, 2022-01-19
Metasploit exploit/multi/misc/weblogic_deserialize_badattr_extcomp WebLogic Server Deserialization RCE BadAttributeValueExpException ExtComp metasploit exploit, normal rank, 2020-04-30
Nuclei template Oracle WebLogic Server - Remote Code Execution nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Oracle Corporation WebLogic Server

References

oracle.com /security-alerts/cpuapr2020.html
vendor-advisory
zerodayinitiative.com /advisories/ZDI-20-504/
third-party-advisory, vdb-entry
zerodayinitiative.com /advisories/ZDI-20-570/
third-party-advisory, vdb-entry
packetstormsecurity.com /files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.html
third-party-advisory, vdb-entry
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883
government-resource, us-government-resource

Sources

CVE List CVE-2020-2883
NVD CVE-2020-2883

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary