CVE-2018-3191: Oracle WebLogic Server T3 deserialization flaw allows unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, plus a very high EPSS percentile, makes this a top-priority patch for exposed WebLogic instances.

What it is

CVE-2018-3191 is a vulnerability in the WLS Core Components subcomponent of Oracle WebLogic Server affecting versions 10.3.6.0, 12.1.3.0 and 12.2.1.3. It is easily exploitable by an unauthenticated attacker with network access via T3 and can result in full takeover of the server. The record does not specify the underlying weakness beyond 'insufficient information', so the exact root cause is not stated here.

Impact

An unauthenticated remote attacker can fully compromise the WebLogic Server, affecting confidentiality, integrity and availability, effectively gaining control of the host and any data or services it exposes.

Attack surface

Reachable over the network through the T3 protocol; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any WebLogic instance exposing T3 to untrusted networks is in scope.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.63188, 99.168th percentile), indicating strong likelihood of exploitation activity. References are patch and advisory entries only; no public exploit tag is present in the record.

What to do

• Apply the Oracle October 2018 CPU patch for WebLogic Server (versions 10.3.6.0, 12.1.3.0, 12.2.1.3) as the primary fix.
• Restrict network access to the T3 listener so only trusted hosts can reach it; block T3 from untrusted networks.
• Where T3 is not required, disable or filter the T3 protocol at the network and WebLogic configuration level.
• Monitor and audit WebLogic instances for unexpected outbound connections or process behavior after exposure.
• If patching is delayed, isolate affected WebLogic servers behind strict network segmentation.

Detection

• Monitor T3 traffic to WebLogic servers for anomalous or unexpected connections from untrusted sources.
• Alert on unusual child processes or command execution spawned by the WebLogic Java process.
• Review WebLogic logs for unexpected deserialization errors, class loading anomalies or T3 handshake irregularities.
• Track outbound network connections from WebLogic hosts to unknown destinations as a possible post-exploitation indicator.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.