CVE-2021-2109: Oracle WebLogic Server Console flaw allows takeover by high-privileged attacker

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high confidentiality, integrity and availability impact, public exploit code and a very high EPSS score, though exploitation requires high privileges.

What it is

Oracle WebLogic Server contains a vulnerability in the Console component affecting versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. A high-privileged attacker with network access via HTTP can exploit it to fully compromise the server. The record does not describe the underlying weakness, as NVD classifies it as insufficient information.

Impact

Successful exploitation results in complete takeover of the WebLogic Server, with high impact to confidentiality, integrity and availability. The attacker gains control of the affected server rather than limited data exposure.

Attack surface

Reachable over the network via HTTP against the WebLogic Console. The CVSS vector requires high privileges (PR:H) and no user interaction (UI:N), so an attacker must already hold administrative-level access to the target.

Exploitation

CISA KEV does not list this CVE, but public exploit code is referenced (PacketStorm tags include Exploit) and EPSS is very high at roughly 0.70 (99th percentile), indicating strong likelihood of exploitation activity.

What to do

• Apply the Oracle January 2021 Critical Patch Update for WebLogic Server (cpujan2021) to all affected versions.
• Restrict network access to the WebLogic Console to trusted administrative networks and block it from untrusted sources.
• Enforce least privilege and strong authentication for WebLogic administrative accounts to reduce exposure to the PR:H precondition.
• Monitor for and remove any unauthorized deployments or configuration changes on WebLogic instances.
• Where the Console is not required, disable or remove it to reduce attack surface.

Detection

• Review WebLogic Console and server logs for unexpected administrative logins or HTTP requests to Console endpoints from unusual sources.
• Alert on new or modified WAR/EAR deployments, JSP files or configuration changes on WebLogic servers.
• Monitor for outbound connections or child processes spawned by the WebLogic Java process that are inconsistent with normal operation.
• Correlate administrative account activity with change-management records to flag unauthorized Console actions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.