CVE-2021-2394: Oracle WebLogic Server Core unauthenticated remote takeover via T3/IIOP

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this a top-priority patching target despite not being in KEV.

What it is

Oracle WebLogic Server Core contains an easily exploitable flaw reachable over the network through T3 and IIOP. Affected versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful exploitation allows full takeover of the WebLogic Server, and the record does not specify the underlying weakness (CWE is listed as insufficient information).

Impact

An attacker gains complete compromise of the WebLogic Server, with high confidentiality, integrity and availability impact. This can lead to code execution and control of the application server and any data or services it hosts.

Attack surface

Reachable over the network via the T3 and IIOP protocols; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.76567, 99.5th percentile), indicating a strong likelihood of exploitation activity. The only references are Oracle vendor advisories, so no public exploit details are provided in this record.

What to do

• Apply the Oracle July 2021 Critical Patch Update for WebLogic Server (cpujul2021) to all affected versions.
• Restrict network access to T3 and IIOP ports to trusted hosts only; block them at the perimeter and between untrusted segments.
• Disable the T3 and IIOP protocols where they are not required by the application.
• Monitor and alert on unexpected T3/IIOP connections and unusual child processes spawned by the WebLogic server.
• If patching is delayed, isolate affected WebLogic instances behind strict network controls and review for signs of compromise.

Detection

• Inspect WebLogic and network logs for anomalous T3 or IIOP traffic, especially from external or unexpected source addresses.
• Monitor for unexpected process creation or command execution originating from the WebLogic server process.
• Alert on new or modified files in WebLogic deployment directories and on outbound connections from the server to unknown hosts.
• Review authentication and access logs for signs of post-exploitation activity on the WebLogic host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.