CVE-2020-14750: Oracle WebLogic Server Console unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network RCE, present in CISA KEV and with an EPSS probability above 99 percent.

What it is

Oracle WebLogic Server's Console component contains an easily exploitable flaw affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access over HTTP can compromise the server. The record does not specify the underlying weakness (CWE is listed as insufficient information), but the impact is full server takeover.

Impact

An attacker gains complete control of the WebLogic Server, affecting confidentiality, integrity and availability. This can lead to code execution and further compromise of hosted applications and data.

Attack surface

Reached over the network via HTTP against the WebLogic Console component. No authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.9927 (99.9th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.

What to do

• Apply the Oracle patch referenced in the vendor security alert for CVE-2020-14750.
• Restrict network access to the WebLogic Console (typically port 7001/7002) to trusted management hosts only.
• Disable or block external exposure of the administration console where it is not required.
• Monitor for and remove any unauthorized deployments or JSP files created on the server.
• Verify affected versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) are upgraded or isolated.

Detection

• Review WebLogic HTTP access logs for requests to console paths from unexpected source IPs.
• Alert on creation of new WAR, JSP or class files in WebLogic deployment directories.
• Monitor for unexpected child processes spawned by the WebLogic Java process.
• Correlate outbound connections from WebLogic hosts to unknown external addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.