CVE-2019-2725
Oracle WebLogic Server, Injection
Description
CVE-2019-2725 is a critical-severity deserialization injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware. The vulnerability exists in the Web Services subcomponent and allows an unauthenticated attacker with network access via HTTP to completely compromise the Oracle WebLogic Server. Successful exploitation of CVE-2019-2725 can result in a full takeover of the affected server, granting the attacker control over confidentiality, integrity, and availability. CISA has confirmed active exploitation in the wild and has identified this vulnerability as being used in ransomware campaigns. With an EPSS score of 94.47% (99.996th percentile), CVE-2019-2725 represents one of the most actively exploited vulnerabilities in the Oracle WebLogic Server ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | agile plm | 9.3.3; 9.3.4; 9.3.5 |
| oracle | communications converged application server | 5.1; 7.0; 7.1 |
| oracle | peoplesoft enterprise peopletools | 8.56; 8.57; 8.58 |
| oracle | storagetek tape analytics sw tool | 2.3 |
| oracle | tape library acsls | 8.5 |
| oracle | tape virtual storage manager gui | 6.2 |
| oracle | vm virtualbox | < 5.2.36; >= 6.0.0, < 6.0.16; >= 6.1.0, < 6.1.2; 5.2.36 |
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html(Patch, Vendor Advisory)
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/108074(Broken Link)
- https://support.f5.com/csp/article/K90059138(Third Party Advisory)
- https://www.exploit-db.com/exploits/46780/(Exploit, Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW(Patch, Vendor Advisory)
- https://www.oracle.com/security-alerts/cpujan2020.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725(US Government Resource)
Weakness Type
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)
CVE-2019-2725 is classified under CWE-74, a broad injection weakness category. In the context of Oracle WebLogic Server, this manifests as a deserialization vulnerability in the Web Services component where specially crafted input is not properly neutralized before being processed by the server. The WebLogic Server fails to adequately validate and sanitize serialized objects received through HTTP requests, allowing attackers to inject malicious payloads that are deserialized and executed on the server.
Learn more: CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
Impact Analysis
CVE-2019-2725 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum possible impact across all security dimensions. The vulnerability is remotely exploitable over the network without any special conditions, making it easy to exploit at scale. No authentication is required and no user interaction is needed, meaning an attacker can autonomously target and compromise vulnerable WebLogic Server instances. Confidentiality (High): Attackers can access all data managed by the WebLogic Server, including application credentials, business data, and configuration secrets. Integrity (High): Complete modification of server configuration, deployed applications, and processed data is possible. Availability (High): Attackers can disrupt service operations, deploy cryptocurrency miners, or render the server inoperable. The confirmed ransomware usage associated with CVE-2019-2725 underscores the severe real-world impact, and the EPSS score of 94.47% confirms this vulnerability is among the most frequently targeted in active exploitation campaigns.
Exploit Maturity
CVE-2019-2725 has a highly mature exploit landscape. Public exploit code is available via Exploit Database and Packet Storm Security, providing ready-to-use remote code execution exploits. CISA has confirmed active exploitation in the wild through the Known Exploited Vulnerabilities catalog, and critically, this vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.47% (99.996th percentile) indicates near-certain exploitation activity, placing it among the most heavily exploited CVEs globally. Federal agencies were required to remediate by 2022-07-10, and organizations running affected WebLogic Server versions should treat this as an emergency-priority remediation item.
Remediation
- Apply Oracle patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Oracle has released patches through Security Alert CVE-2019-2725 and subsequent Critical Patch Updates (CPU July 2019, January 2020).
- Upgrade affected Oracle WebLogic Server installations from versions 10.3.6.0.0 and 12.1.3.0.0 to the latest supported and patched versions. Also verify and update other affected Oracle products including Agile PLM (9.3.3-9.3.5), Communications Converged Application Server (5.1, 7.0, 7.1), PeopleSoft Enterprise PeopleTools (8.56-8.58), and VM VirtualBox (upgrade to 6.1.2+).
- If immediate patching is not possible, restrict network access to the WebLogic Server administration console and T3/IIOP protocols using firewall rules. Block HTTP access to the vulnerable Web Services endpoints, specifically the
/_async/*and/wls-wsat/*URL paths. - Monitor WebLogic Server logs for suspicious deserialization activity, unusual process spawning, and indicators of compromise associated with known exploit payloads. Conduct threat hunting for post-exploitation artifacts such as web shells, cryptocurrency miners, and ransomware deployment.
- Implement network segmentation to isolate WebLogic Server instances from critical internal networks and databases, limiting the blast radius of a potential compromise. Deploy a Web Application Firewall (WAF) with rules to detect and block known Oracle WebLogic exploitation patterns.
Technical Details
CVE-2019-2725 exploits a deserialization vulnerability in the Web Services component of Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0. The vulnerability allows an unauthenticated attacker to send specially crafted HTTP requests containing malicious serialized Java objects to the WebLogic Server, which are deserialized without proper validation. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability profile: network-accessible, low complexity, no privileges required, and no user interaction needed. The vulnerable endpoints include the asynchronous web services handler and the WLS-WSAT component, which process incoming SOAP requests containing serialized objects. When a malicious payload is deserialized, it triggers arbitrary code execution in the context of the WebLogic Server process, giving the attacker full control over the application server and access to all connected resources including databases and internal network services.
Frequently Asked Questions
Is CVE-2019-2725 being actively exploited?
Yes. CVE-2019-2725 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. More critically, this vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.47% (99.996th percentile) indicates it is one of the most heavily exploited vulnerabilities globally.
What products are affected by CVE-2019-2725?
The primary affected product is Oracle WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0 within Oracle Fusion Middleware. Additional affected Oracle products include Agile PLM (9.3.3, 9.3.4, 9.3.5), Communications Converged Application Server (5.1, 7.0, 7.1), PeopleSoft Enterprise PeopleTools (8.56, 8.57, 8.58), StorageTek Tape Analytics (2.3), Tape Library ACSLS (8.5), Tape Virtual Storage Manager GUI (6.2), and VM VirtualBox (versions prior to 5.2.36, 6.0.16, and 6.1.2).
How do I fix CVE-2019-2725?
Apply Oracle security patches from Security Alert CVE-2019-2725 and subsequent Critical Patch Updates. Upgrade WebLogic Server versions 10.3.6.0.0 and 12.1.3.0.0 to patched releases. As an interim measure, block HTTP access to the vulnerable /_async/* and /wls-wsat/* endpoints and restrict network access to WebLogic administration interfaces.
How severe is CVE-2019-2725?
CVE-2019-2725 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier. The EPSS score of 94.47% places it in the 99.996th percentile for exploitation likelihood. Combined with confirmed ransomware usage and publicly available exploit code, this vulnerability demands immediate remediation for any exposed Oracle WebLogic Server instance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.