CVE-2016-3510: Oracle WebLogic Server WLS Core Components deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required and very high EPSS, though the record lacks exploit detail and KEV listing.

What it is

An unspecified flaw in Oracle WebLogic Server's WLS Core Components affects versions 10.3.6.0, 12.1.3.0 and 12.2.1.0. A reference points to a MarshalledObject deserialization remote code execution issue, and the CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N) indicates it is remotely reachable without credentials or user interaction.

Impact

An unauthenticated remote attacker can fully compromise confidentiality, integrity and availability of the WebLogic Server, in practice likely executing arbitrary code on the host.

Attack surface

Reached over the network against the WebLogic Server WLS Core Components; the vector shows no privileges and no user interaction required. The description does not specify the exact endpoint or protocol.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.914 probability, 99.8th percentile) and a public Packet Storm reference describes deserialization RCE, indicating mature public exploitation.

What to do

• Apply the Oracle July 2016 Critical Patch Update for WebLogic Server (cpujul2016-2881720) or a later CPU.
• Upgrade off the affected 10.3.6.0, 12.1.3.0 and 12.2.1.0 releases to a supported, patched version.
• Restrict network access to WebLogic administration and T3/IIOP ports to trusted hosts only.
• Disable or filter deserialization of untrusted Java objects where the application allows it, and monitor for MarshalledObject payloads.
• Where patching is delayed, isolate exposed WebLogic instances behind a reverse proxy or WAF with deserialization filtering.

Detection

• Monitor WebLogic server logs and network traffic for T3/IIOP connections carrying serialized Java objects, especially MarshalledObject payloads.
• Alert on unexpected child processes spawned by the WebLogic JVM (java.exe/wls processes launching cmd, bash, powershell).
• Watch for outbound connections from WebLogic hosts to unfamiliar external addresses shortly after inbound T3 traffic.
• Baseline and alert on new JSP files or class files written under WebLogic deployment directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.