CVE-2015-4852: Oracle WebLogic Server T3 deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active KEV listing, near-maximum EPSS probability, and public exploit code make this a top-priority remote code execution flaw.

What it is

The WLS Security component in Oracle WebLogic Server deserializes untrusted Java objects received over the T3 protocol on TCP port 7001, allowing remote command execution. The flaw stems from the bundled Apache Commons Collections library (com.bea.core.apache.commons.collections.jar), which enables gadget-chain exploitation during deserialization. It matters because WebLogic is widely exposed and the flaw is trivially reachable without credentials.

Impact

An unauthenticated remote attacker can execute arbitrary commands with the privileges of the WebLogic process, leading to full server compromise. This can result in data theft, lateral movement, and persistent access to the host.

Attack surface

Reached over the network via crafted serialized Java objects sent in T3 protocol traffic to TCP port 7001. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2015-4852 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.96032 (99.874th percentile). Multiple references are tagged Exploit, including public exploit code and Exploit-DB entries, indicating mature, widely available exploitation.

What to do

• Apply the Oracle CPU patches referenced in the advisory links, prioritizing the January 2016 and later updates that address this CVE.
• Restrict network access to TCP port 7001 and the T3 protocol to trusted hosts only; do not expose WebLogic administration or T3 endpoints to the internet.
• Disable or filter T3 protocol traffic where not required, or use WebLogic connection filters to block untrusted T3 clients.
• Remove or upgrade the vulnerable Apache Commons Collections library if it is not required by the application.
• Monitor for and block known deserialization exploit payloads at the network perimeter where feasible.

Detection

• Monitor network traffic to TCP port 7001 for T3 protocol handshakes and serialized Java object payloads from untrusted sources.
• Inspect WebLogic server logs for deserialization errors, unexpected class loading, or command execution artifacts following T3 connections.
• Use host-based detection to alert on child processes spawned by the WebLogic Java process, especially shell or command interpreters.
• Hunt for known exploit tool signatures and payload patterns associated with Java deserialization gadget chains in network or endpoint telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.