CVE-2023-21839: Oracle WebLogic Server unauthenticated deserialization data access flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with public exploit code, an EPSS near 1.0, and unauthenticated network reachability, making active exploitation highly likely.

What it is

Oracle WebLogic Server Core contains a deserialization of untrusted data flaw (CWE-502) combined with missing authentication for a critical function (CWE-306). An unauthenticated network attacker can reach it over T3 or IIOP and gain unauthorized access to critical data. It affects supported versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.

Impact

The attacker gains unauthorized access to critical data or complete access to all data reachable through Oracle WebLogic Server. The CVSS vector rates only confidentiality impact (C:H), with no integrity or availability effect.

Attack surface

Reachable over the network via the T3 and IIOP protocols; the vector shows no privileges required and no user interaction. No authentication is needed to trigger the flaw.

Exploitation

Listed in CISA KEV since 2023-05-01 with a 2023-05-22 remediation due date, and EPSS is 0.999 (99.965th percentile). Public exploit references are tagged Exploit, indicating working exploit code is available.

What to do

• Apply the Oracle January 2023 Critical Patch Update for WebLogic Server (cpujan2023) to versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
• Restrict network access to T3 and IIOP ports so only trusted hosts can reach the WebLogic listener.
• Disable or filter the T3 and IIOP protocols where they are not required by applications.
• Monitor for and block deserialization payloads against WebLogic endpoints, and isolate exposed instances behind a reverse proxy or firewall.
• Verify remediation against the CISA KEV due date and confirm no unpatched internet-facing instances remain.

Detection

• Monitor WebLogic T3/IIOP traffic for anomalous serialized payloads or unexpected deserialization activity.
• Alert on outbound connections or process behavior from WebLogic servers consistent with post-exploitation data access.
• Audit WebLogic logs for unexpected T3/IIOP requests from untrusted source addresses.
• Track patch state of WebLogic instances against the affected versions and the KEV due date.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.