pwn.watch: WebLogic incident updates

[high] Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Mon, 24 Aug 2026 00:00:00 GMT

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. Added to CISA KEV on 2026-08-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-24: CISA added CVE-2026-21962 to the KEV catalog (due 2026-08-27).

CVEs: CVE-2026-21962

[critical] Oracle WebLogic Server: WebLogic Server Unspecified Vulnerability

Tue, 07 Jan 2025 00:00:00 GMT

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3. Added to CISA KEV on 2025-01-07.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-01-07: CISA added CVE-2020-2883 to the KEV catalog (due 2025-01-28).

CVEs: CVE-2020-2883

[critical] Oracle WebLogic Server Remote Code Execution

Wed, 18 Sep 2024 00:00:00 GMT

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-18: CISA added CVE-2020-14644 to the KEV catalog (federal deadline 2024-10-09) (source)

CVEs: CVE-2020-14644

[high] Oracle WebLogic Server OS Command Injection

Mon, 03 Jun 2024 00:00:00 GMT

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-06-03: CISA added CVE-2017-3506 to the KEV catalog (federal deadline 2024-06-24) (source)

CVEs: CVE-2017-3506

[high] Oracle WebLogic Server: Unspecified (CVE-2023-21839)

Mon, 01 May 2023 00:00:00 GMT

Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. Added to CISA KEV on 2023-05-01.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-05-01: CISA added CVE-2023-21839 to the KEV catalog (due 2023-05-22).

CVEs: CVE-2023-21839