CVE-2018-2894: Oracle WebLogic Server unauthenticated HTTP takeover flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and full server takeover, combined with a very high EPSS percentile, makes this a top remediation priority.

What it is

Oracle WebLogic Server contains an easily exploitable vulnerability in the WLS - Web Services subcomponent affecting versions 12.1.3.0, 12.2.1.2 and 12.2.1.3. An unauthenticated attacker with network access via HTTP can compromise the server, and successful exploitation results in full takeover. The record does not specify the underlying weakness, as NVD classifies it as insufficient information.

Impact

An attacker gains complete control of the WebLogic Server, with high confidentiality, integrity and availability impact. This can lead to data theft, service disruption and use of the host as a foothold for further attacks.

Attack surface

Reachable over the network via HTTP against the WebLogic Web Services component. No authentication and no user interaction are required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is 0.50224 (98.9th percentile), indicating a high likelihood of attempted exploitation. References are limited to the Oracle patch advisory and third-party trackers, with no public exploit tag supplied.

What to do

• Apply the Oracle July 2018 Critical Patch Update for WebLogic Server, or upgrade to a fixed release.
• Restrict network access to WebLogic HTTP ports to trusted hosts and management networks.
• Disable or block access to unused Web Services endpoints where feasible.
• Monitor Oracle advisories for updated guidance on affected versions.
• Run WebLogic with least privilege and isolate it from sensitive internal systems.

Detection

• Inspect WebLogic HTTP access and server logs for anomalous requests to Web Services endpoints.
• Alert on unexpected child processes or file writes spawned by the WebLogic process.
• Monitor for new or modified JSP, WAR or deployment artifacts on WebLogic hosts.
• Correlate outbound connections from WebLogic servers with known malicious infrastructure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.