ZeroDay Findings
Sign inSign up

Findings

CVE-2015-4852

Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Published Nov 18, 2015 · updated Jun 16, 2026 · oracle virtual desktop infrastructure

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 18, 2015 · Catalog

    Detected

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe oracle/storagetek tape analytics sw tool2.3
  • cpe oracle/virtual desktop infrastructureversion unspecified
  • cpe oracle/weblogic server10.3.6.0.0
  • cpe oracle/weblogic server12.1.2.0.0
  • cpe oracle/weblogic server12.1.3.0.0
  • cpe oracle/weblogic server12.2.1.0.0
  • vendor Oracle WebLogic Serverversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2015-4852

    Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2015-4852

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2015-4852

    30-day exploitation probability 95.0%

    first.org
  • Exploit DatabasePublic exploit reference42806

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference44552

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference46628

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleexploit_multi/misc/weblogic_deserialize_rawobject

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2015-4852

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache

    nvd.nist.gov

References