CVE-2020-14644
Oracle WebLogic Server Remote Code Execution Vulnerability
Description
CVE-2020-14644 is a critical remote code execution vulnerability in Oracle WebLogic Server, affecting versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The flaw resides in the Core component and can be exploited by unauthenticated attackers over IIOP or T3 protocols to achieve full server takeover. With a CVSS score of 9.8 and an EPSS probability of 93.64% (99.8th percentile), this vulnerability represents an extreme risk. It has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of October 9, 2024, underscoring its active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.oracle.com/security-alerts/cpujul2020.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14644(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2020-14644 by NVD. However, the vulnerability is best characterized as an unsafe deserialization issue in Oracle WebLogic Server's IIOP and T3 protocol handling. WebLogic Server has historically been susceptible to deserialization attacks through these protocols, where malicious serialized Java objects are sent to the server and processed without adequate validation. This allows attackers to execute arbitrary code within the context of the WebLogic Server process. The lack of input validation on serialized data transmitted through these proprietary protocols is the fundamental weakness that enables exploitation.
Impact Analysis
The business impact of CVE-2020-14644 is severe across all dimensions. Confidentiality is fully compromised, meaning attackers can access any data processed by the WebLogic Server, including database credentials, session tokens, and sensitive business data stored within deployed applications. Integrity is equally affected, as attackers gain the ability to modify application logic, inject backdoors, alter database records, and tamper with business transactions processed through the server. Availability faces complete disruption since attackers can shut down the server, deploy ransomware, or consume resources to deny service to legitimate users.
The attack requires no authentication and no user interaction, making it trivially exploitable from any network location that can reach the WebLogic Server's IIOP or T3 ports. With an EPSS score of 93.64%, the probability of exploitation within the next 30 days is extraordinarily high. The CISA KEV listing notes that the ransomware association is currently unknown, but the ease of exploitation and full system compromise capability make it an attractive target for ransomware operators. Organizations running exposed WebLogic Server instances face potential data breaches, operational disruption, and regulatory penalties.
Exploit Maturity
CVE-2020-14644 is under active exploitation in the wild, as confirmed by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 9, 2024. The EPSS score of 93.64% (99.8th percentile) indicates near-certain exploitation activity, placing it among the most actively targeted vulnerabilities globally. While the KEV entry lists the ransomware association as "Unknown," the nature of the vulnerability — unauthenticated remote code execution — makes it highly suitable for ransomware deployment. WebLogic Server has been a consistent target for threat actors, and exploitation tools for T3 and IIOP deserialization vulnerabilities are widely available in offensive security frameworks. Organizations should assume that any internet-facing WebLogic Server instance running affected versions has already been probed or compromised.
Remediation
-
Apply the Oracle Critical Patch Update (CPU) from July 2020 immediately by downloading and installing the latest patches from Oracle's security advisory. This is the primary fix that addresses the deserialization vulnerability in the Core component.
-
Restrict network access to T3 and IIOP protocols by configuring firewall rules and WebLogic Server connection filters to block external access to T3 (port 7001/7002) and IIOP ports. Only allow connections from trusted internal hosts that require these protocols for inter-server communication.
-
Upgrade to the latest WebLogic Server version if running 12.2.1.3.0, 12.2.1.4.0, or 14.1.1.0.0. Oracle regularly releases cumulative patches, and upgrading to the newest supported version ensures protection against this and subsequent vulnerabilities.
-
Conduct a compromise assessment on any WebLogic Server instances that were exposed prior to patching. Look for unauthorized web shells, new user accounts, scheduled tasks, and unusual outbound network connections that could indicate an existing breach.
-
Implement a Web Application Firewall (WAF) with rules to inspect and filter T3/IIOP traffic for serialized Java objects containing known exploit payloads, providing an additional layer of defense while patches are being deployed.
Technical Details
CVE-2020-14644 carries a CVSS v3.1 base score of 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:N) confirms the vulnerability is exploitable over the network without physical or adjacent access. Attack Complexity (AC:L) indicates no special conditions or timing requirements are needed for exploitation. Privileges Required (PR:N) means no authentication is necessary, making the attack accessible to any network-connected adversary. User Interaction (UI:N) confirms the attack is fully automated without requiring any action from a user or administrator. Scope (S:U) indicates the impact remains within the WebLogic Server security context. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all rated High, signifying total compromise of data secrecy, data correctness, and service availability.
The attack mechanism targets WebLogic Server's handling of serialized Java objects received through the T3 and IIOP protocols. These protocols are used for remote method invocation (RMI) and inter-server communication in Oracle Fusion Middleware environments. When a crafted serialized object is transmitted to the WebLogic Server, the deserialization process instantiates the object without sufficient validation, triggering arbitrary code execution. The attacker constructs a gadget chain — a sequence of existing Java classes that, when deserialized in a specific order, result in command execution on the underlying operating system. This technique leverages classes already present in the WebLogic Server classpath.
Frequently Asked Questions
What is CVE-2020-14644?
CVE-2020-14644 is a critical remote code execution vulnerability in Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. It allows unauthenticated attackers to fully compromise the server via the IIOP or T3 protocols without any user interaction.
How do I know if my WebLogic Server is vulnerable?
Check your WebLogic Server version through the Administration Console or by running the weblogic.version utility. If you are running version 12.2.1.3.0, 12.2.1.4.0, or 14.1.1.0.0 without the July 2020 Critical Patch Update applied, your server is vulnerable. You can verify patch status through Oracle's OPatch utility.
Can this vulnerability be exploited remotely?
Yes, this is a network-exploitable vulnerability that requires no authentication and no user interaction. Any attacker who can reach the T3 (typically port 7001) or IIOP ports of your WebLogic Server can exploit this vulnerability to execute arbitrary code with the privileges of the server process.
Is this vulnerability being used in ransomware attacks?
While CISA's KEV catalog lists the ransomware association as "Unknown," the vulnerability provides unauthenticated remote code execution — the ideal entry point for ransomware deployment. WebLogic Server vulnerabilities have historically been leveraged by ransomware groups, and organizations should treat this as a high-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.