CVE-2020-2555: Oracle Multiple Products Remote Code Execution Vulnerability
Vulnerability summary
CVE-2020-2555 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in Oracle Multiple Products. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 97.12% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 6 public exploits are recorded.
Timeline
- 15-01-2020PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVOracle Multiple Products Remote Code Execution Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
97.12%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 97.12% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2020-2555
Public exploits
6 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Show all 6 exploits
Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution
Maturity: poc
WebLogic Server - Deserialization RCE - BadAttributeValueExpException (Metasploit)
Maturity: weaponized
WebLogic Server Deserialization RCE - BadAttributeValueExpException
exploit/multi/misc/weblogic_deserialize_badattrval
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Oracle9 products
- access_manager11.1.2.3.0
- coherence3.7.1.0 | 12.1.3.0.0 | 12.2.1.3.0 | 12.2.1.4.0
- commerce_platform≥ 11.3.0, ≤ 11.3.2 | 11.0.0 | 11.1.0 | 11.2.0
- communications_diameter_signaling_router≥ 8.0.0, ≤ 8.2.2
- healthcare_data_repository7.0.1
Oracle corporation2 products
- utilities framework4.2.0.2.0 | 4.2.0.3.0 | 4.3.0.1.0-4.3.0.6.0 | 4.4.0.0.0 | 4.4.0.2.0
- webcenter portal12.2.1.3.0 | 12.2.1.4.0
2 vendors · 11 products
References
9 links- packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2555Government ResourceUS Government Resource