← Vulnerability feed

Vulnerability record · CVE-2019-2729 · published 19 June 2019

CVE-2019-2729: Oracle WebLogic Server Web Services improper access control RCE

Oracle · Communications Diameter Signaling Router

CVE-2019-2729 is an improper access control flaw (CWE-284) in the Web Services subcomponent of Oracle WebLogic Server, affecting versions 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0.0. An unauthenticated attacker with network access via HTTP can exploit it to take over the server, and Oracle issued an out-of-band security alert with patches.

9.8 CVSS 3.1 Critical EPSS 89% · top 0.2% CWE-284 · Improper access control
9.8CVSS 3.1 base score, v2 7.5
89%EPSS exploitation probability, 30 days
NoNot in CISA KEV
9Affected product versions listed by NVD
14References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated network exploitation, full server takeover impact, public exploit references and very high EPSS make this an urgent patch target.

What it is

CVE-2019-2729 is an improper access control flaw (CWE-284) in the Web Services subcomponent of Oracle WebLogic Server, affecting versions 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0.0. An unauthenticated attacker with network access via HTTP can exploit it to take over the server, and Oracle issued an out-of-band security alert with patches.

Impact

Successful exploitation allows full takeover of the WebLogic Server, with high impact to confidentiality, integrity and availability. The attacker gains the ability to execute code and control the affected server.

Attack surface

Reachable over the network via HTTP against the Web Services component; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

The record is not listed in CISA KEV, but EPSS is very high (0.8883, 99.768th percentile) and references include an Exploit-tagged Packet Storm entry describing remote command execution, indicating public exploit material exists.

What to do

  • Apply the Oracle out-of-band patch for CVE-2019-2729 and subsequent CPU patches for WebLogic Server.
  • Upgrade or migrate off the affected versions 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0.0 where supported.
  • Restrict network access to WebLogic HTTP/T3 ports to trusted hosts only.
  • Monitor Oracle security alerts for further WebLogic Web Services fixes and apply them promptly.

Detection

  • Inspect WebLogic HTTP access logs for anomalous requests to Web Services endpoints from unexpected sources.
  • Monitor for unexpected child processes or command execution spawned by the WebLogic server process.
  • Alert on exploitation attempts using known WebLogic Web Services payload patterns in HTTP request bodies.
  • Track outbound connections from WebLogic hosts that may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/155886/Oracle-Weblogic-10.3.6.0.0-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html PatchVendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
https://www.oracle.com/security-alerts/cpuapr2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2021.html PatchThird Party Advisory
http://packetstormsecurity.com/files/155886/Oracle-Weblogic-10.3.6.0.0-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2729-5570780.html PatchVendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch
https://www.oracle.com/security-alerts/cpuapr2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2021.html PatchThird Party Advisory

Track CVE-2019-2729 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-35273Oracle PeopleSoft PeopleTools missing authentication allows takeoverOracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component) in versions 8.61 and 8.62 is missing authentication for a critica…KEVEPSS 9.4%analysed9.8CVE-2025-61757Oracle Identity Manager REST WebServices missing authentication allows takeoverOracle Fusion Middleware Identity Manager exposes a REST WebServices component that fails to require authentication for a critical function (CWE-306)…KEVEPSS 89%analysed9.8CVE-2020-2555Oracle Coherence T3 deserialization allows unauthenticated remote code executionOracle Coherence (Fusion Middleware) deserializes untrusted data reachable over the T3 protocol, allowing an unauthenticated network attacker to exec…KEVEPSS 97%analysed9.8CVE-2019-2725Oracle WebLogic Server Web Services deserialization RCEOracle WebLogic Server's Web Services subcomponent contains an injection flaw (CWE-74) that allows unauthenticated remote code execution over HTTP. I…KEVEPSS 100%analysed9.8CVE-2017-9841PHPUnit eval-stdin.php remote PHP code executionPHPUnit before 4.8.28 and 5.x before 5.6.3 ships Util/PHP/eval-stdin.php, which evaluates HTTP POST body content as PHP when it begins with a "<?php …KEVEPSS 100%analysed10.0CVE-2017-10151Oracle identity manager vulnerabilityVulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Supported versions that are affec…EPSS 3.9%10.0CVE-2008-0340Oracle application server vulnerabilityMultiple unspecified vulnerabilities in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 have unknown impact and remote atta…EPSS 2.6%10.0CVE-2008-0343Oracle application server vulnerabilityUnspecified vulnerability in the Oracle Spatial component in Oracle Database 9.0.1.5 FIPS+, 9.2.0.8, 9.2.0.8DV, and 10.1.0.5 has unknown impact and r…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2019-2729), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.