Vulnerability record · CVE-2023-21931 · published 18 April 2023
CVE-2023-21931: Oracle WebLogic Server T3 pre-auth data access flaw
Oracle · Weblogic Server
Oracle WebLogic Server Core contains a missing-authentication flaw reachable over the T3 protocol. An unauthenticated network attacker can exploit it to read data the server can access. It matters because WebLogic is widely exposed and the flaw needs no credentials or user interaction.
Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated network-reachable data exposure with a very high EPSS score and public exploit references, though not in KEV and limited to confidentiality impact.
What it is
Oracle WebLogic Server Core contains a missing-authentication flaw reachable over the T3 protocol. An unauthenticated network attacker can exploit it to read data the server can access. It matters because WebLogic is widely exposed and the flaw needs no credentials or user interaction.
Impact
An attacker gains unauthorized read access to critical data, up to all data accessible to the WebLogic Server instance. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reached over the network via the T3 protocol; the CVSS vector shows no privileges required and no user interaction, so it is pre-authentication. Any WebLogic T3 listener exposed to untrusted networks is in scope.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.82262, 99.6th percentile), and a public Packet Storm reference is titled pre-auth remote command execution, indicating public exploit material exists.
What to do
- Apply the Oracle April 2023 CPU patch for WebLogic Server (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0).
- Restrict network access to T3/T3S ports to trusted hosts only; do not expose them to the internet.
- Disable the T3 protocol where it is not required, or filter T3 traffic at the perimeter.
- Monitor Oracle advisories for follow-up patches and re-check exposure after upgrading.
Detection
- Alert on unexpected T3 connections from external or untrusted source IPs to WebLogic listeners.
- Review WebLogic access and HTTP logs for anomalous T3 handshake or serialized-payload activity.
- Baseline normal T3 clients and flag new or rare source addresses.
- Watch for post-exploitation reads of configuration or credential stores on WebLogic hosts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-21931 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-21931), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
