← Vulnerability feed

Vulnerability record · CVE-2016-0638 · published 21 April 2016

CVE-2016-0638: Oracle WebLogic Server JMS flaw allows remote compromise

Oracle · Weblogic Server

Oracle WebLogic Server contains an unspecified vulnerability in the Java Messaging Service component affecting versions 10.3.6, 12.1.2, 12.1.3, and 12.2.1. The record gives no root-cause detail, but the CVSS 3.0 vector rates it 9.8 critical with full confidentiality, integrity, and availability impact, so it warrants prompt attention.

9.8 CVSS 3.0 Critical EPSS 63% · top 0.8%
9.8CVSS 3.0 base score, v2 7.5
63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and full impact, plus a very high EPSS percentile, makes this a top remediation priority despite thin technical detail.

What it is

Oracle WebLogic Server contains an unspecified vulnerability in the Java Messaging Service component affecting versions 10.3.6, 12.1.2, 12.1.3, and 12.2.1. The record gives no root-cause detail, but the CVSS 3.0 vector rates it 9.8 critical with full confidentiality, integrity, and availability impact, so it warrants prompt attention.

Impact

A remote attacker can compromise confidentiality, integrity, and availability of the WebLogic Server, potentially gaining full control of the affected service.

Attack surface

Reachable over the network via the Java Messaging Service, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.62924 (99.2nd percentile), indicating a high modeled likelihood of exploitation; reference tags only cover patch and vendor advisory material.

What to do

  • Apply the Oracle April 2016 Critical Patch Update for WebLogic Server (CPUApr2016v3) on all affected versions.
  • If patching cannot be immediate, restrict network access to WebLogic JMS ports and management interfaces to trusted hosts.
  • Disable or block JMS/T3 protocols from untrusted networks where they are not required.
  • Monitor Oracle advisories for follow-up fixes and verify version inventory against 10.3.6, 12.1.2, 12.1.3, and 12.2.1.

Detection

  • Monitor WebLogic server logs for anomalous JMS-related errors or unexpected deserialization activity.
  • Alert on unusual inbound connections to WebLogic JMS/T3 ports from external or untrusted sources.
  • Baseline and watch for unexpected child processes or outbound connections spawned by the WebLogic JVM.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html PatchVendor Advisory
http://www.securitytracker.com/id/1035615
https://www.tenable.com/security/research/tra-2016-09
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html PatchVendor Advisory
http://www.securitytracker.com/id/1035615
https://www.tenable.com/security/research/tra-2016-09

Track CVE-2016-0638 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-22965Spring Framework data binding remote code execution (Spring4Shell)Spring MVC and Spring WebFlux applications on JDK 9+ can be exploited through data binding to achieve remote code execution. The known exploit path r…KEVEPSS 100%analysed9.8CVE-2020-14750Oracle WebLogic Server Console unauthenticated remote code executionOracle WebLogic Server's Console component contains an easily exploitable flaw affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and …KEVEPSS 99%analysed9.8CVE-2020-14882Oracle WebLogic Server Console unauthenticated remote code executionThe Oracle WebLogic Server Console component contains an easily exploitable flaw that lets an unauthenticated attacker with network access take over …KEVEPSS 100%analysed9.8CVE-2020-14644Oracle WebLogic Server unauthenticated RCE via IIOP and T3Oracle WebLogic Server Core contains an easily exploitable flaw reachable over the network through IIOP and T3. An unauthenticated attacker can explo…KEVEPSS 95%analysed9.8CVE-2020-2883Oracle WebLogic Server Core unauthenticated remote code execution via IIOP/T3Oracle WebLogic Server Core contains an easily exploitable vulnerability reachable over the network through IIOP and T3. An unauthenticated attacker …KEVEPSS 95%analysed9.8CVE-2020-2551Oracle WebLogic Server IIOP Deserialization RCEOracle WebLogic Server contains an easily exploitable vulnerability in WLS Core Components reachable over IIOP. An unauthenticated network attacker c…KEVEPSS 93%analysed9.8CVE-2019-2725Oracle WebLogic Server Web Services deserialization RCEOracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. I…KEVEPSS 100%analysed9.8CVE-2018-2628Oracle WebLogic Server T3 deserialization allows unauthenticated remote takeoverOracle WebLogic Server contains a deserialization of untrusted data flaw (CWE-502) in the WLS Core Components, reachable over the T3 protocol. An una…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2016-0638), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.