CVE-2021-2397

published 2021-07-21

CVE-2021-2397: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0…

Priority P2 63 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

10 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2021-2397 is exploitable via the T3 protocol — monitor/block T3 traffic to Oracle WebLogic Server ports (default 7001, 7002) from untrusted networks ↗
• → CVE-2021-2397 is also exploitable via the IIOP protocol — monitor/block IIOP traffic to Oracle WebLogic Server from untrusted networks ↗
• → Successful exploitation results in full server takeover (RCE) — alert on unexpected child processes spawned by WebLogic JVM processes ↗
• → No authentication is required; any unauthenticated inbound T3/IIOP connection to WebLogic should be treated as suspicious if originating from external/untrusted sources ↗

• · Affected versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 — detections and mitigations should be scoped to these versions ↗
• · The vulnerability is in the Core component of Oracle WebLogic Server (part of Oracle Fusion Middleware); detections should target the WebLogic Core deserialization/network stack specifically ↗
• · Attack vector is Network with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), meaning perimeter controls alone are insufficient if T3/IIOP ports are exposed ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.