CVE-2020-2551: Oracle WebLogic Server IIOP Deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network exploitation, active inclusion in CISA KEV and a very high EPSS probability make this an urgent patch target.

What it is

Oracle WebLogic Server contains an easily exploitable vulnerability in WLS Core Components reachable over IIOP. An unauthenticated network attacker can exploit it to fully compromise the server. It affects versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0.

Impact

Successful exploitation results in complete takeover of the WebLogic Server, with high confidentiality, integrity and availability impact. The attacker gains full control of the affected server and any data or services it hosts.

Attack surface

Reached over the network via the IIOP protocol; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any host that can reach the IIOP listener can attempt exploitation.

Exploitation

CVE-2020-2551 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-11-16), indicating active exploitation in the wild. EPSS gives a 30-day exploitation probability of about 93% (99.8th percentile), and the vendor advisory is tagged as a patch reference.

What to do

• Apply the Oracle Critical Patch Update (January 2020) for WebLogic Server, or upgrade to a fixed release.
• If patching is not immediately possible, restrict network access to the IIOP/T3 ports to trusted hosts only.
• Disable or block IIOP if it is not required by the deployment.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
• Monitor for and remove any web shells or persistence left after a suspected compromise.

Detection

• Monitor network traffic to WebLogic IIOP/T3 ports for anomalous or unexpected connections.
• Inspect WebLogic server logs for IIOP-related errors or unusual deserialization activity.
• Hunt for unexpected child processes spawned by the WebLogic Java process (e.g., cmd.exe, /bin/sh).
• Check for newly created JSP files or other web-accessible artifacts in WebLogic deployment directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.