CVE-2019-2725: Oracle WebLogic Server Web Services deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with a public exploit, CISA KEV listing, ransomware use, and near-maximum EPSS score make this an urgent patch-or-mitigate case.

What it is

Oracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. It affects versions 10.3.6.0.0 and 12.1.3.0.0, and a public exploit exists, making it a high-value target for mass scanning and ransomware operations.

Impact

An unauthenticated attacker can fully compromise the WebLogic server, gaining control over confidentiality, integrity, and availability. This enables arbitrary code execution, data theft, and use of the host as a pivot or ransomware deployment point.

Attack surface

Reachable over the network via HTTP with no authentication or user interaction required, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed or internally reachable WebLogic instance on the affected versions is at risk.

Exploitation

CVE-2019-2725 is listed in CISA KEV with known ransomware campaign use, has a public Exploit-DB entry, and an EPSS 30-day probability of 0.99964 (99.975th percentile), indicating active and widespread exploitation.

What to do

• Apply the Oracle CPU patches referenced in the vendor advisories (alert-cve-2019-2725 and cpujul2019) immediately.
• If patching is not possible, restrict network access to WebLogic HTTP ports and disable the wls-wsat and _async components where feasible.
• Monitor for and block exploitation attempts targeting the /wls-wsat/ and /_async/ endpoints at the perimeter.
• Isolate affected WebLogic servers from untrusted networks and enforce least-privilege service accounts.
• Verify no unauthorized changes or web shells remain after patching, as exploitation may have already occurred.

Detection

• Inspect HTTP logs for POST requests to /wls-wsat/CoordinatorPortType, /wls-wsat/RegistrationPortTypeRPC, or /_async/AsyncResponseService with XML payloads.
• Monitor for unexpected child processes spawned by the WebLogic Java process (e.g., cmd.exe, /bin/sh, powershell).
• Alert on outbound connections from WebLogic servers to unusual external IPs or ports, which may indicate reverse shells or payload downloads.
• Search for newly created JSP files or modified web application directories that could be web shells.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.