CVE-2020-2555: Oracle Coherence T3 deserialization allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with CVSS 9.8, KEV listing and near-maximum EPSS makes this an urgent patch-first item.

What it is

Oracle Coherence (Fusion Middleware) deserializes untrusted data reachable over the T3 protocol, allowing an unauthenticated network attacker to execute code. Affected supported versions are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Because it is network-reachable, unauthenticated and leads to full takeover, it is a high-value target for initial access.

Impact

An attacker gains full compromise of the Oracle Coherence process, with high confidentiality, integrity and availability impact, effectively host takeover under the service account. No user interaction or credentials are required.

Attack surface

Reached over the network via the T3 protocol; the CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are needed. Any internet- or network-exposed T3 listener on an affected Coherence deployment is in scope.

Exploitation

CISA added it to KEV on 2021-11-03 with a 2022-05-03 remediation due date, and EPSS is 0.97116 (99.89th percentile). Multiple references are tagged Exploit, indicating public exploit code exists; no ransomware campaign use is documented in this record.

What to do

• Apply the Oracle CPU patches referenced in the advisory (cpujan2020, cpuoct2020, cpujul2021) for the affected Coherence versions.
• Restrict network access to T3/Coherence ports to trusted hosts only; do not expose them to untrusted networks.
• Where T3 is not required, disable or block the T3 protocol and filter deserialization traffic at the network boundary.
• Run Coherence under a least-privilege service account to limit post-exploitation impact.
• Verify remediation against the CISA KEV due date and track closure.

Detection

• Monitor network traffic to Coherence/T3 ports for anomalous or unexpected connections, especially from external or non-application hosts.
• Alert on Java deserialization payload patterns and known Coherence/WebLogic exploit signatures in IDS/IPS and network logs.
• Watch for unexpected child processes spawned by the Coherence/Java service account, which may indicate post-exploitation execution.
• Audit Coherence and WebLogic logs for T3 connection errors, unusual class loading or serialization exceptions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.