CVE-2020-14645: Oracle WebLogic Server Core unauthenticated remote takeover via IIOP/T3

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction and full server takeover, plus a high EPSS percentile, makes this a top remediation priority despite the absence of KEV listing.

What it is

Oracle WebLogic Server Core contains an easily exploitable flaw reachable over the network through IIOP and T3. An unauthenticated attacker can fully compromise the server, affecting confidentiality, integrity and availability. The record does not describe the underlying weakness beyond 'insufficient information'.

Impact

Successful exploitation results in complete takeover of the WebLogic Server, giving the attacker control over the application server and any data or services it hosts.

Attack surface

Reachable over the network via the IIOP and T3 protocols; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.47 (98.8th percentile), indicating elevated likelihood of exploitation activity. The only references are Oracle vendor advisories, so no public exploit details are confirmed in this record.

What to do

• Apply the Oracle July 2020 Critical Patch Update for WebLogic Server (versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0).
• Restrict network access to T3 and IIOP ports so only trusted hosts can reach them.
• Disable or filter the T3/IIOP protocols where they are not required by applications.
• Monitor and alert on unexpected deserialization or protocol traffic to WebLogic listeners.
• Isolate WebLogic servers behind segmentation and least-privilege service accounts to limit blast radius.

Detection

• Inspect WebLogic server logs and HTTP/T3 access logs for anomalous IIOP or T3 requests from untrusted sources.
• Monitor for unexpected child processes or outbound connections spawned by the WebLogic JVM.
• Alert on unusual deserialization-related errors or class-loading activity in WebLogic logs.
• Track network flows to T3/IIOP ports from hosts outside the expected client set.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.