CVE-2020-2883: Oracle WebLogic Server Unspecified Vulnerability
Vulnerability summary
CVE-2020-2883 is a critical (CVSS 9.8) vulnerability in Oracle WebLogic Server. It is known to be exploited: CISA lists it, first on 07-01-2025. EPSS estimates a 94.58% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 15-04-2020PublishedVulnerability first disclosed.
- 07-01-2025Added to CISA KEVOracle WebLogic Server Unspecified Vulnerability
- 28-01-2025CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 12-01-2026Last modifiedVulnerability information updated.
Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
94.58%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
-0.35 pp
From 94.93% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 07-01-2025
- Federal due date
- 28-01-2025
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. www.oracle.com/security-alerts/cpuapr2020.html nvd.nist.gov/vuln/detail/CVE-2020-2883
Public exploits
1 foundWebLogic Server Deserialization RCE BadAttributeValueExpException ExtComp
exploit/multi/misc/weblogic_deserialize_badattr_extcomp
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Oracle1 product
- weblogic_server10.3.6.0.0 | 12.1.3.0.0 | 12.2.1.3.0 | 12.2.1.4.0
Oracle corporation1 product
- weblogic server10.3.6.0.0 | 12.1.3.0.0 | 12.2.1.3.0 | 12.2.1.4.0
2 vendors · 2 products
References
5 links- packetstormsecurity.com/files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883Government ResourceUS Government Resource