CVE-2018-2628: Oracle WebLogic Server T3 deserialization allows unauthenticated remote takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network RCE, CISA KEV listing, public exploits and near-maximum EPSS make this an urgent patch-or-mitigate item.

What it is

Oracle WebLogic Server contains a deserialization of untrusted data flaw (CWE-502) in the WLS Core Components, reachable over the T3 protocol. An unauthenticated network attacker can send crafted serialized data to the T3 listener and achieve remote code execution, leading to full takeover of the server. The affected supported versions are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3.

Impact

Successful exploitation gives the attacker complete control of the WebLogic Server process, with high confidentiality, integrity and availability impact. This typically means arbitrary code execution in the server's context and potential lateral movement into connected systems.

Attack surface

The flaw is reached over the network via the T3 protocol, which is exposed by default on WebLogic Server. No authentication or user interaction is required, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-09-08, and public Exploit-DB entries exist, indicating active exploitation. EPSS is 0.99448 (99.9th percentile), consistent with very high likelihood of exploitation.

What to do

• Apply the Oracle April 2018 CPU patch for the affected WebLogic versions (10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3) as the primary fix.
• Restrict network access to the T3/T3S listener so only trusted hosts can reach it; block T3 from untrusted networks.
• If T3 is not required, disable the T3 protocol or filter it at the network layer.
• Run WebLogic with least privilege and isolate it from sensitive internal networks to limit post-exploitation movement.
• Monitor for and apply any later Oracle CPU updates that supersede the April 2018 fix.

Detection

• Monitor network traffic to WebLogic T3 ports for anomalous serialized payloads or unexpected T3 handshakes from untrusted sources.
• Alert on WebLogic server process spawning child processes such as cmd.exe, /bin/sh, or other unexpected executables.
• Review WebLogic logs for T3 connection errors, deserialization exceptions, or unusual class loading activity.
• Hunt for outbound connections from WebLogic hosts to unknown external IPs following T3 traffic, which may indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.