CVE-2018-2893: Oracle WebLogic Server T3 deserialization flaw allows unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a very high EPSS score, makes this a top-priority patch.

What it is

CVE-2018-2893 is a vulnerability in the WLS Core Components subcomponent of Oracle WebLogic Server affecting versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. It is easily exploitable by an unauthenticated attacker with network access via T3 and can result in full takeover of the server. The record does not specify the underlying weakness beyond 'insufficient information'.

Impact

An attacker can fully compromise the WebLogic Server, affecting confidentiality, integrity and availability. This amounts to complete takeover of the affected server.

Attack surface

Reachable over the network through the T3 protocol; no authentication and no user interaction are required per the CVSS vector. Any host that can reach the T3 listener can attempt exploitation.

Exploitation

The record is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.71196, 99.378th percentile), indicating a strong likelihood of exploitation activity. Reference tags only include Patch and Vendor Advisory, with no public exploit references supplied.

What to do

• Apply the Oracle July 2018 Critical Patch Update for WebLogic Server, which is the vendor patch referenced in the advisory.
• Upgrade or migrate off the affected versions (10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3) where possible.
• Restrict network access to the T3 listener so only trusted hosts can reach it.
• If T3 is not required, disable or filter the T3 protocol at the network and WebLogic configuration level.
• Monitor and alert on unexpected T3 connections and unusual child processes spawned by the WebLogic JVM.

Detection

• Inspect WebLogic and network logs for anomalous T3 traffic, especially from untrusted sources.
• Monitor for unexpected process creation or command execution originating from the WebLogic server process.
• Alert on outbound connections from WebLogic hosts to unfamiliar destinations, which may indicate post-exploitation activity.
• Review WebLogic server logs for errors or exceptions associated with T3 request handling.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.