CVE-2020-2883: Oracle WebLogic Server Core unauthenticated remote code execution via IIOP/T3

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated network RCE with CISA KEV listing and EPSS above 0.94 makes this an urgent patch-first issue.

What it is

Oracle WebLogic Server Core contains an easily exploitable vulnerability reachable over the network through IIOP and T3. An unauthenticated attacker can exploit it to fully compromise the server. The record does not specify the underlying defect beyond a deserialization RCE reference, and CWE is listed as insufficient information.

Impact

Successful exploitation results in complete takeover of the WebLogic Server, with high confidentiality, integrity and availability impact. The attacker gains code execution in the server's context.

Attack surface

Reachable over the network via the IIOP and T3 protocols; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2020-2883 is listed in CISA KEV (added 2025-01-07) and has an EPSS 30-day probability of 0.94928 (99.857th percentile), indicating active exploitation and very high likelihood. Reference tags include third-party advisories describing WebLogic deserialization remote code execution.

What to do

• Apply the Oracle April 2020 Critical Patch Update (cpuapr2020) or later for affected WebLogic versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0.
• If patching is not immediately possible, restrict network access to T3 and IIOP ports to trusted hosts only, or disable the T3/IIOP protocols where not required.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
• Segment and monitor WebLogic servers so that a compromised instance cannot reach sensitive internal systems.
• Verify no unauthorized changes to WebLogic configuration, deployed applications or startup scripts after patching.

Detection

• Monitor network traffic for unexpected T3 or IIOP connections, especially from external or untrusted sources.
• Inspect WebLogic server logs for deserialization errors, unexpected class loading or anomalous request patterns on T3/IIOP endpoints.
• Alert on new or modified JSP files, WAR/EAR deployments, or child processes spawned by the WebLogic Java process.
• Hunt for outbound connections from WebLogic hosts to unknown external addresses that may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.