CVE Watch—

CVE-2020-14644

Oracle WebLogic Server Remote Code Execution Vulnerability

CVSS

—

No CVSS

EPSS

94.5%

p100

KEV

YES

Sep 18, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

94.5%EPSS · 30 days94.5%

2026-09-162026-10-14

KEV catalog record

Product

Oracle / WebLogic Server

Vulnerability

Oracle WebLogic Server Remote Code Execution Vulnerability

Added to KEV

Sep 18, 2024

Remediate by

Oct 9, 2024

Known ransomware use

Summary description

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.oracle.com/security-alerts/cpujul2020.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-14644

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2019-27259.8 CRI

100.0%

KEV—80Oracle WebLogic Server, Injection14d CVE-2017-102717.5 HIG

100.0%

KEV—80Oracle Corporation WebLogic Server Remote Code Execution Vulnerability63d CVE-2020-14882—

100.0%

KEV—80Oracle WebLogic Server Remote Code Execution Vulnerability—CVE-2018-2628—

100.0%

KEV—80Oracle WebLogic Server Unspecified Vulnerability—CVE-2023-21839—

100.0%

KEV—80Oracle WebLogic Server Unspecified Vulnerability—CVE-2020-14750—

99.9%

KEV—80Oracle WebLogic Server Remote Code Execution Vulnerability—