CVE-2020-14644
published 2020-07-15CVE-2020-14644: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2024-10-09
Exploited in the wild
EPSS
94.47%
99.8th percentile
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
othercom.tangosol.internal.util.invoke.RemoteConstructor
othercom.tangosol.internal.util.invoke.ClassDefinition
othercom/superream/EvilObjMin
snort
alert tcp any any -> $HOME_NET any (msg:"ET WEB_SERVER Oracle WebLogic Server Remote Code Execution via Insecure Deserialization (CVE-2020-14644)"; flow:established,to_server; content:"com.tangosol.internal.util.invoke.RemoteConstructor"; fast_pattern; content:"com.tangosol.internal.util.invoke.ClassDefinition"; content:"ClassIdentity"; content:"getRuntime"; reference:url,www.kingkk.com/2020/08/CVE-2020-14644%E5%88%86%E6%9E%90%E4%B8%8Egadget%E7%9A%84%E4%B8%80%E4%BA%9B%E6%80%9D%E8%80%83/; reference:cve,2020-14644; classtype:attempted-user; sid:2067134; rev:1; metadata:affected_product Oracle_WebLogic, attack_target Server, created_at 2026_01_27, cve CVE_2020_14644, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_01_27, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes
cafebabe
- →Exploit traffic targets WebLogic T3/IIOP protocols; monitor for T3 handshake bytes ('t3 7.0.0.0\nAS:10\nHL:19\n\n') followed by a large serialized payload containing RemoteConstructor class references.
- →Network detection: look for TCP streams to WebLogic servers (default port 7001) containing the strings 'com.tangosol.internal.util.invoke.RemoteConstructor', 'com.tangosol.internal.util.invoke.ClassDefinition', 'ClassIdentity', and 'getRuntime' in the same flow.
- →Shodan/asset discovery queries to identify exposed WebLogic instances: cpe:"cpe:2.3:a:oracle:weblogic_server", product:"WebLogic", http.server:"WebLogic", port:7001.
- →FOFA query to identify exposed WebLogic instances: product="WebLogic" || header="WebLogic Server".
- →The exploit embeds a Java class (EvilObjMin) with a malicious ClassDefinition payload containing a Java class file (magic bytes cafebabe) that calls Runtime.exec(); detect Java class file magic bytes in T3/IIOP streams.
- →Exploit uses two-stage OOB callback: Linux via 'curl http://rce-linux.<oast>' and Windows via 'cmd.exe /c powershell curl http://rce-window.<oast>'; monitor DNS/HTTP for subdomains prefixed with 'rce-linux' or 'rce-window'.
- →The exploit payload contains the serialized class name 'com/superream/EvilObjMin' and its inner class '320225A4FE015B7FBC621C6037CD7F50'; presence of these strings in network traffic or heap dumps is a strong indicator of exploitation.
- ·The vulnerability is exploitable via both T3 and IIOP protocols; ensure detection rules cover both protocol paths, not just HTTP/HTTPS traffic. ↗
- ·Affected versions are specifically 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0; version checks should be part of triage to reduce false positives on patched instances. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_oracle9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rfrh-3q7r-m8g9: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
ghsa_unreviewed·2022-05-24
CVE-2020-14644 [HIGH] GHSA-rfrh-3q7r-m8g9: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle WebLogic Server Remote Code Execution Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-14644 [CRITICAL] Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle WebLogic Server Remote Code Execution Vulnerability
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Affected: Oracle WebLogic Server
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.forescout.com/resources/anatomy-of-an-attack-hunters-international-ransomware/
Remediation Due: 2024-10-09
CISA
Oracle WebLogic Server Remote Code Execution Vulnerability
cisa·2024-09-18·CVSS 9.8
CVE-2020-14644 [CRITICAL] Oracle WebLogic Server Remote Code Execution Vulnerability
Vulnerability: Oracle WebLogic Server Remote Code Execution Vulnerability
Affected: Oracle WebLogic Server
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.oracle.com/security-alerts/cpujul2020.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-14644
Remediation Due Date: 2024-10-09
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Core — CVE-2020-14644
vendor_oracle·2020-07-15·CVSS 9.8
CVE-2020-14644 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Core — CVE-2020-14644
Oracle Oracle Fusion Middleware Risk Matrix: Core vulnerability
CVE: CVE-2020-14644
CVSS: 9.8
Protocol: IIOP, T3
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2020 (JUL 2020)
Suricata
ET WEB_SERVER Oracle WebLogic Server Remote Code Execution via Insecure Deserialization (CVE-2020-14644)
suricata·2026-01-27·CVSS 9.8
CVE-2020-14644 [CRITICAL] ET WEB_SERVER Oracle WebLogic Server Remote Code Execution via Insecure Deserialization (CVE-2020-14644)
ET WEB_SERVER Oracle WebLogic Server Remote Code Execution via Insecure Deserialization (CVE-2020-14644)
Rule: alert tcp any any -> $HOME_NET any (msg:"ET WEB_SERVER Oracle WebLogic Server Remote Code Execution via Insecure Deserialization (CVE-2020-14644)"; flow:established,to_server; content:"com.tangosol.internal.util.invoke.RemoteConstructor"; fast_pattern; content:"com.tangosol.internal.util.invoke.ClassDefinition"; content:"ClassIdentity"; content:"getRuntime"; reference:url,www.kingkk.com/2020/08/CVE-2020-14644%E5%88%86%E6%9E%90%E4%B8%8Egadget%E7%9A%84%E4%B8%80%E4%BA%9B%E6%80%9D%E8%80%83/; reference:cve,2020-14644; classtype:attempted-user; sid:2067134; rev:1; metadata:affected_product Oracle_WebLogic, attack_target Server, created_at 2026_01_27, cve CVE_2020_14644, deployment Peri
Nuclei
Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)
nuclei·CVSS 9.8
CVE-2020-14644 [CRITICAL] Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)
Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)
Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.
Template:
id: CVE-2020-14644
info:
name: Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)
author: hnd3884
severity: critical
description: |
Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.
impact: |
Attackers can fully compromise the server, leading to data breach, service disruption, and potent
Bleepingcomputer
CISA warns of actively exploited Apache HugeGraph-Server bug
blogs_bleepingcomputer·2024-09-19·CVSS 8.8
CVE-2024-27348 [HIGH] CISA warns of actively exploited Apache HugeGraph-Server bug
## CISA warns of actively exploited Apache HugeGraph-Server bug
## Bill Toulas
The U.S. Cybersecurity and Infrastructure Agency (CISA) has added five flaws to its Known Exploited Vulnerabilities (KEV) catalog, among which is a remote code execution (RCE) flaw impacting Apache HugeGraph-Server.
The flaw, tracked as CVE-2024-27348 and rated critical (CVSS v3.1 score: 9.8), is an improper access control vulnerability that impacts HugeGraph-Server versions from 1.0.0 and up to, but not including 1.3.0.
Apache fixed the vulnerability on April 22, 2024, with the release of version 1.3.0. Apart from upgrading to the latest version, users were also recommended to use Java 11 and enable the Auth system .
Also, enabling the "Whitelist-IP/port" function was proposed to improve the security of th
Tenable
Oracle Critical Patch Update for July 2020 Tops Previous Record with 443 Security Updates
blogs_tenable·2020-07-15
Oracle Critical Patch Update for July 2020 Tops Previous Record with 443 Security Updates
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
2020-07-15
Published
2024-09-18
Added to CISA KEV
Exploited in the wild