CVE-2020-2555
Oracle Multiple Products Remote Code Execution Vulnerability
Description
CVE-2020-2555 is a critical-severity deserialization vulnerability affecting multiple Oracle products, including Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, and Oracle Communications Diameter Signaling Router (DSR). This remote code execution vulnerability allows an unauthenticated attacker with network access via T3 or HTTP to take over the affected system through unsafe deserialization of Java objects. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 93.03% (99.8th percentile), CVE-2020-2555 has a near-certain probability of active exploitation, making it one of the most dangerous Oracle vulnerabilities currently tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | access manager | 11.1.2.3.0 |
| oracle | coherence | 3.7.1.0; 12.1.3.0.0; 12.2.1.3.0; 12.2.1.4.0 |
| oracle | commerce platform | >= 11.3.0, <= 11.3.2; 11.0.0; 11.1.0; 11.2.0 |
| oracle | communications diameter signaling router | >= 8.0.0, <= 8.2.2 |
| oracle | healthcare data repository | 7.0.1 |
| oracle | rapid planning | 12.1; 12.2 |
| oracle | retail assortment planning | 15.0; 16.0 |
| oracle | utilities framework | >= 4.3.0.1.0, <= 4.3.0.6.0; 4.2.0.2.0; 4.2.0.3.0; 4.4.0.0.0; 4.4.0.2.0 |
| oracle | webcenter portal | 12.2.1.3.0; 12.2.1.4.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.oracle.com/security-alerts/cpujan2020.html(Vendor Advisory)
- https://www.oracle.com/security-alerts/cpujan2021.html(Vendor Advisory)
- https://www.oracle.com/security-alerts/cpujul2020.html(Vendor Advisory)
- https://www.oracle.com/security-alerts/cpujul2021.html(Patch, Vendor Advisory)
- https://www.oracle.com/security-alerts/cpuoct2020.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2555(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
Deserialization of Untrusted Data occurs when an application deserializes data from an untrusted source without sufficient validation, allowing attackers to inject malicious objects into the processing stream. In the case of CVE-2020-2555, Oracle Coherence improperly deserializes objects received via the T3 protocol, enabling remote attackers to execute arbitrary code on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2020-2555 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum exploitability and impact potential. The vulnerability is remotely exploitable over the network without physical access, requires low attack complexity with no special conditions needed, and demands no authentication or user interaction to trigger. Confidentiality (High): An attacker can read any data accessible to the Oracle Coherence process, including sensitive business information and database credentials. Integrity (High): Successful exploitation allows arbitrary code execution, enabling attackers to modify data, plant backdoors, or alter application logic. Availability (High): Attackers can crash the application server or consume resources, causing complete denial of service. The EPSS score of 93.03% places this vulnerability in the 99.8th percentile, indicating near-certain exploitation activity across the internet.
Exploit Maturity
CVE-2020-2555 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for this vulnerability via Packet Storm Security and additional exploits targeting WebLogic Server and deserialization payloads. The EPSS score of 93.03% indicates near-certain exploitation activity, placing it among the most actively targeted vulnerabilities. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Oracle has released patches via multiple Critical Patch Updates (CPU) including January 2020, July 2020, October 2020, and July 2021.
- Verify that all instances of affected Oracle Coherence versions (3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0) and related products such as Oracle Commerce Platform, Oracle Utilities Framework, Oracle Communications Diameter Signaling Router, and Oracle WebCenter Portal have been updated to patched versions.
- Restrict access to the T3 protocol on TCP port 7001 using firewall rules and network segmentation. Block T3 protocol access from untrusted networks and limit it to only authorized administrative hosts.
- Monitor T3 protocol traffic for anomalous serialized Java objects and review application server logs for unexpected process execution, class loading, or outbound network connections that could indicate exploitation.
- Implement deserialization filtering on the application server to block known malicious gadget chains. Consider deploying a Web Application Firewall (WAF) with rules targeting Java deserialization attack patterns.
Technical Details
CVE-2020-2555 resides in the Oracle Coherence product of Oracle Fusion Middleware, specifically within the Caching, CacheStore, and Invocation components. The vulnerability exploits insecure Java deserialization in the T3 protocol listener on TCP port 7001. When an attacker sends a specially crafted serialized Java object via the T3 protocol, Oracle Coherence deserializes it without proper validation, allowing the attacker to instantiate arbitrary Java classes and execute code in the context of the application server process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is trivially achievable from any network position without credentials, and results in full system compromise across all three security dimensions.
Frequently Asked Questions
Is CVE-2020-2555 being actively exploited?
Yes. CVE-2020-2555 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.03% (99.8th percentile) places it among the most actively targeted vulnerabilities. No known ransomware campaigns are currently associated with this vulnerability.
What products are affected by CVE-2020-2555?
CVE-2020-2555 affects multiple Oracle products including Oracle Coherence (versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0), Oracle Commerce Platform (11.0.0 through 11.3.2), Oracle Communications Diameter Signaling Router (8.0.0 through 8.2.2), Oracle Utilities Framework (4.2.0.2.0 through 4.4.0.2.0), Oracle WebCenter Portal (12.2.1.3.0, 12.2.1.4.0), Oracle Rapid Planning (12.1, 12.2), and Oracle Healthcare Data Repository (7.0.1).
How do I fix CVE-2020-2555?
Apply Oracle's Critical Patch Update immediately. Specifically, update all affected Oracle Coherence and related product instances to the latest patched versions. If immediate patching is not possible, restrict T3 protocol access on port 7001 to trusted networks only and implement deserialization filtering.
How severe is CVE-2020-2555?
CVE-2020-2555 has a CVSS 3.1 score of 9.8 (CRITICAL), the near-maximum severity rating. With an EPSS score in the 99.8th percentile and confirmed active exploitation, this is an extremely high-priority vulnerability that requires immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.