Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 on Exploit-DB
- Exploitation: active
- Automatable: yes
- Technical impact: total
Summary
Oracle WebLogic Server, a widely used Java application server that is part of Oracle Fusion Middleware, is affected by this flaw in its Web Services component. An attacker who can reach the server over the network via HTTP, without needing any login, could fully take over the server, gaining control over its data confidentiality, integrity, and availability.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-46780, EDB-46814, EDB-46814
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- CISA SSVC assessment
Exploitation: active · Automatable: yes · Technical impact: total
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Oracle Corporation Tape Library ACSLS
8.5