CVE-2018-3245: Oracle WebLogic Server T3 deserialization allows unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and a public exploit plus very high EPSS make this an urgent patch target.

What it is

Oracle WebLogic Server contains a deserialization of untrusted data flaw (CWE-502) in the WLS Core Components subcomponent. It affects versions 10.3.6.0, 12.1.3.0 and 12.2.1.3, and is reachable over the network via the T3 protocol without authentication. Successful exploitation allows full compromise of the WebLogic Server.

Impact

An unauthenticated attacker can take over the WebLogic Server, gaining high impact to confidentiality, integrity and availability. This typically means arbitrary code execution in the server's context.

Attack surface

Reached over the network through the T3 protocol; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any exposed T3 listener on an affected version is a candidate entry point.

Exploitation

A public exploit exists (Exploit-DB 46513) and EPSS is very high at 0.94281 (99.8th percentile), though the CVE is not listed in CISA KEV. This indicates active, practical exploitation is likely.

What to do

• Apply the Oracle October 2018 CPU patch for WebLogic Server (versions 10.3.6.0, 12.1.3.0, 12.2.1.3) as the first action.
• Restrict network access to T3/T3S ports so only trusted hosts can reach them.
• Disable the T3 protocol where it is not required, or filter T3 traffic at the network edge.
• If patching is delayed, isolate affected WebLogic instances behind strict firewall rules and monitor for anomalous T3 connections.
• Review and harden WebLogic deserialization filters if available for the deployed version.

Detection

• Monitor network traffic for T3 protocol connections to WebLogic servers, especially from unexpected sources.
• Inspect WebLogic server logs for deserialization errors, unexpected class loading, or T3 handshake anomalies.
• Use host-based detection for child processes spawned by the WebLogic Java process (e.g., cmd.exe, /bin/sh) indicating code execution.
• Alert on outbound connections from WebLogic servers to unknown external hosts following T3 activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.