CVE-2025-21535
published 2025-01-21CVE-2025-21535: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and…
PriorityP191critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEVRansomware
Exploited in the wild
EPSS
0.80%
52.6th percentile
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | oracle_weblogic_server | — | — |
| oracle_corporation | oracle_weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2025-21535 exploits Oracle WebLogic Server via the T3 and IIOP protocols — monitor and restrict inbound T3 (default port 7001/7002) and IIOP traffic to WebLogic servers from untrusted networks ↗
- →Affected versions are WebLogic 12.2.1.4.0 and 14.1.1.0.0 — prioritize detection and patching on hosts running these specific versions ↗
- →Successful exploitation results in full server takeover (RCE) — alert on unexpected process spawning from WebLogic JVM processes (e.g., java.exe or weblogic spawning cmd.exe, sh, curl, wget) ↗
- ·Exploitation requires network access via T3 or IIOP protocols; blocking or filtering these protocols at the network perimeter for untrusted sources significantly reduces attack surface ↗
- ·The vulnerability is in the Core component of Oracle WebLogic Server — patching guidance is provided in Oracle's January 2025 Critical Patch Update (cpujan2025) ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
vendor_oracle9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q45q-cm8g-fhw5: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
ghsa_unreviewed·2025-01-21
CVE-2025-21535 [CRITICAL] CWE-306 GHSA-q45q-cm8g-fhw5: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle WebLogic Server Missing Authentication for Critical Function
vulncheck·2025·CVSS 9.8
CVE-2025-21535 [CRITICAL] Oracle WebLogic Server Missing Authentication for Critical Function
Oracle WebLogic Server Missing Authentication for Critical Function
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected: Oracle WebLogic Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Core — CVE-2025-21535
vendor_oracle·2025-01-15·CVSS 9.8
CVE-2025-21535 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Core — CVE-2025-21535
Oracle Oracle Fusion Middleware Risk Matrix: Core vulnerability
CVE: CVE-2025-21535
CVSS: 9.8
Protocol: T3, IIOP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications followed,
Qualys
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
blogs_qualys·2025-01-23
Oracle Critical Patch Update, January 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 85 constituting about 27% of the total patches released. Oracle MySQL and Oracle Financial Services Applications fol
2025-01-21
Published
Exploited in the wild