CVE-2021-2136

published 2021-04-22

CVE-2021-2136: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2021-2136 exploits Oracle WebLogic Server via the IIOP protocol; monitor/block IIOP traffic (typically TCP port 7001/7002) to WebLogic servers from untrusted sources ↗
• → Successful exploitation results in full server takeover (RCE); alert on unexpected child processes spawned by WebLogic JVM processes as a post-exploitation indicator ↗
• → Affected versions are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0; prioritize detection and patching on hosts running these specific WebLogic versions ↗

• · No authentication or user interaction is required; the attack is network-accessible with low complexity, meaning any exposed IIOP port is at risk without additional mitigating configuration ↗
• · The vulnerability is in the Core component of Oracle WebLogic Server; disabling or firewalling the IIOP listener is a potential mitigation if the protocol is not required ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.