CVE-2020-14841: Oracle WebLogic Server IIOP flaw allows unauthenticated takeover

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction and full server takeover, plus a high EPSS score, makes this a top remediation priority despite the absence of KEV listing.

What it is

Oracle WebLogic Server Core contains an easily exploitable vulnerability reachable over IIOP that lets an unauthenticated network attacker compromise the server. It affects versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0, and successful exploitation results in full takeover. The record does not specify the underlying weakness, as NVD classifies it as insufficient information.

Impact

An attacker gains complete control of the WebLogic Server, with high impact to confidentiality, integrity and availability. That typically means code execution in the server's context and access to hosted applications and data.

Attack surface

Reachable over the network via IIOP; the CVSS vector shows no privileges required and no user interaction. Any exposed IIOP listener on an affected WebLogic instance is a candidate entry point.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is high at roughly 0.52 (99th percentile), indicating elevated likelihood of exploitation activity. References are vendor patch and ZDI advisories only, with no public exploit tag in the record.

What to do

• Apply the Oracle October 2020 CPU patch for WebLogic Server, or upgrade to a fixed release.
• If IIOP is not required, disable or block the IIOP/T3 protocols and restrict the listener to trusted networks.
• Segment WebLogic management and internal protocol ports behind firewalls; do not expose them to untrusted networks.
• Monitor Oracle advisories and ZDI references for updated guidance and re-check affected versions after patching.

Detection

• Alert on unexpected inbound connections to WebLogic IIOP/T3 ports from untrusted sources.
• Look for anomalous child processes or command execution spawned by the WebLogic JVM.
• Monitor for unusual outbound connections or file writes from WebLogic server processes.
• Review WebLogic logs for IIOP-related errors or unexpected deserialization activity around suspicious connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.