CVE-2001-0098: BEA WebLogic Server URL buffer overflow allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 score of 10 and very high EPSS, though the product is legacy and likely rare in current environments.

What it is

BEA WebLogic Server before 5.1.0 contains a buffer overflow reachable through a long URL beginning with a ".." string. A remote, unauthenticated attacker can trigger the overflow and execute arbitrary commands on the server. The flaw is severe because it requires no credentials and yields full control of the affected host.

Impact

An attacker gains arbitrary command execution with the privileges of the WebLogic service, which typically means full compromise of the server and any data or credentials it holds.

Attack surface

Reachable over the network via HTTP by sending a crafted long URL starting with ".."; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.784, 99.6th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade BEA WebLogic Server to version 5.1.0 or later, which resolves the overflow.
• If upgrade is not immediately possible, restrict network access to the WebLogic HTTP listener to trusted hosts only.
• Run the WebLogic service under a low-privilege account to limit the impact of command execution.
• Monitor vendor advisories and apply any backported fixes for the affected branch.

Detection

• Inspect web server and WebLogic access logs for unusually long request URLs, especially those beginning with "..".
• Alert on URL lengths exceeding normal application baselines or containing repeated dot sequences.
• Monitor for unexpected child processes spawned by the WebLogic service account.
• Watch for outbound connections from the WebLogic host that do not match normal application traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.