CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
Published Oct 21, 2020 · updated Jun 16, 2026 · oracle weblogic server
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Timeline
Detection, updates, and resolution for this record.
Oct 21, 2020 · Catalog
Detected
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeove
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeove
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe oracle/weblogic server10.3.6.0.0
- cpe oracle/weblogic server12.1.3.0.0
- cpe oracle/weblogic server12.2.1.3.0
- cpe oracle/weblogic server12.2.1.4.0
- cpe oracle/weblogic server14.1.1.0.0
- vendor Oracle WebLogic Serverversion unspecified
Sources
- CISA KEVCVE-2020-14882
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
cisa.gov - CVE.orgCVE-2020-14882
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-14882
30-day exploitation probability 100.0%
first.org - Exploit Database49479
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/weblogic_admin_handle_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-14882
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with netw
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/161128/Oracle-WebLogic-Server-12.2.1.0-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityp://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com