CVE-2020-14882
Oracle WebLogic Server Remote Code Execution Vulnerability
Description
CVE-2020-14882 is a critical remote code execution vulnerability in Oracle WebLogic Server, a widely deployed Java application server used in enterprise environments. The vulnerability exists in the Console component of Oracle Fusion Middleware and allows an unauthenticated attacker with network access via HTTP to completely take over the affected Oracle WebLogic Server. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.45% (99.99th percentile), this Oracle WebLogic Server vulnerability has a near-certain probability of exploitation and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | weblogic server | 10.3.6.0.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0 |
References
- http://packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161128/Oracle-WebLogic-Server-12.2.1.0-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpuoct2020.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14882(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2020-14882 by NVD. The vulnerability is classified as an unspecified remote code execution flaw in the Oracle WebLogic Server Console component, closely related to CVE-2020-14750 which addresses an incomplete patch for the same attack surface.
Impact Analysis
CVE-2020-14882 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting maximum severity across nearly all dimensions. The vulnerability is remotely exploitable over HTTP without any authentication or user interaction, making it trivially accessible to attackers across the internet. Attack complexity is low, meaning no special conditions or preparation are required for successful exploitation. Successful attacks result in complete takeover of Oracle WebLogic Server, with high impact to confidentiality, integrity, and availability — attackers can read all data, modify configurations and deployed applications, and disrupt service availability entirely. The EPSS score of 94.45% places this vulnerability at the 99.99th percentile, indicating near-certain active exploitation. Organizations running affected WebLogic Server versions face immediate risk of full server compromise if this vulnerability remains unpatched.
Exploit Maturity
CVE-2020-14882 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for CVE-2020-14882 via Packet Storm Security, with additional exploit variants published at Packet Storm Security (Console Handle RCE) and Packet Storm Security (12.2.1.0 RCE). The EPSS score of 94.45% (99.99th percentile) indicates near-certain exploitation activity. This vulnerability is frequently chained with CVE-2020-14883, which allows authenticated attackers to execute commands — together they form a complete unauthenticated remote code execution chain against WebLogic Server. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply Oracle Critical Patch Update immediately as mandated by CISA KEV: Apply updates per vendor instructions. The fix is available in Oracle's October 2020 Critical Patch Update.
- Upgrade all Oracle WebLogic Server instances from affected versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) to the latest patched release. Also apply the supplemental patch for CVE-2020-14750 which addresses bypass techniques for this vulnerability.
- If immediate patching is not possible, restrict access to the WebLogic Server Administration Console by blocking HTTP access to the console path (/console/) from untrusted networks using firewall rules or reverse proxy configurations.
- Monitor WebLogic Server logs for suspicious access patterns targeting the Administration Console, particularly unusual HTTP requests to console endpoints. Review network traffic for indicators of compromise and unauthorized remote access.
- As a long-term hardening measure, ensure WebLogic Administration Console is never directly exposed to the internet, implement network segmentation to isolate application server tiers, and enable strong authentication for all management interfaces.
Technical Details
CVE-2020-14882 affects the Console component of Oracle WebLogic Server in Oracle Fusion Middleware. The vulnerability allows an unauthenticated attacker with network access via HTTP to achieve complete server takeover. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires no privileges, no user interaction, and has low attack complexity over a network vector. The vulnerability is related to CVE-2020-14750, which was issued as a supplemental patch after researchers discovered that the initial fix for CVE-2020-14882 could be bypassed through URL encoding techniques. Affected versions span the full range of supported WebLogic Server releases including 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, making this a widespread threat across enterprise Oracle deployments.
Frequently Asked Questions
Is CVE-2020-14882 being actively exploited?
Yes. CVE-2020-14882 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.45% (99.99th percentile) further indicates near-certain exploitation activity, and multiple public exploits are available.
What products are affected by CVE-2020-14882?
CVE-2020-14882 affects Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The vulnerability is in the Console component of Oracle Fusion Middleware.
How do I fix CVE-2020-14882?
Apply Oracle's Critical Patch Update from October 2020 and the supplemental patch for CVE-2020-14750. Upgrade all affected WebLogic Server instances to the latest patched versions. If patching is not immediately possible, restrict network access to the WebLogic Administration Console.
How severe is CVE-2020-14882?
CVE-2020-14882 has a CVSS 3.1 base score of 9.8 (CRITICAL) and an EPSS score of 94.45% at the 99.99th percentile. This represents a maximum-severity vulnerability that requires no authentication to exploit remotely and can result in complete server takeover.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.