CVE-2022-21306

published 2022-01-19

CVE-2022-21306: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0…

Priority P2 66 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2022-21306 is exploitable over the T3 protocol (Oracle WebLogic proprietary protocol); monitor and restrict T3/T3S traffic to WebLogic servers (default ports 7001/7002) from untrusted networks ↗
• → No authentication is required to exploit this vulnerability; any unauthenticated T3 connection attempt to affected WebLogic versions (12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) should be treated as suspicious ↗
• → Successful exploitation results in full server takeover (C/I/A all HIGH); prioritize detection of anomalous T3 deserialization payloads or unexpected process spawning from WebLogic JVM processes ↗

• · Affected versions are specifically 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 — scope detection and patching efforts to these versions only ↗
• · The vulnerable component is the WebLogic Core; the attack vector is network-based with no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N), meaning perimeter-level T3 filtering is a critical compensating control ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_oracle 9.8 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.