CVE-2020-14644: Oracle WebLogic Server unauthenticated RCE via IIOP and T3

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network RCE with confirmed exploitation in CISA KEV and a very high EPSS score.

What it is

Oracle WebLogic Server Core contains an easily exploitable flaw reachable over the network through IIOP and T3. An unauthenticated attacker can exploit it to fully compromise the server, affecting confidentiality, integrity and availability. It is listed in CISA KEV, so it is being exploited in the wild.

Impact

An attacker gains complete takeover of the WebLogic Server, including code execution with the server's privileges and full read/write access to its data.

Attack surface

Reachable over the network via the IIOP and T3 protocols; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-18 with a remediation due date of 2024-10-09, and EPSS gives a 30-day probability of 0.94548 (99.85th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Oracle July 2020 Critical Patch Update for WebLogic Server 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
• If patching cannot be done immediately, restrict network access to T3 and IIOP ports to trusted hosts only.
• Disable or block the T3 and IIOP protocols where they are not required by applications.
• Isolate exposed WebLogic instances behind a firewall or reverse proxy and monitor for exploitation attempts.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Detection

• Monitor WebLogic logs and network traffic for anomalous T3 and IIOP requests, especially serialized payloads.
• Alert on unexpected child processes or command execution spawned by the WebLogic Java process.
• Watch for outbound connections from WebLogic servers to unfamiliar hosts, which may indicate post-exploitation activity.
• Audit for unauthorized changes to WebLogic configuration, deployed applications or new admin accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.