WaratekVRT Sign in

CVE-2018-2628 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3
Severity9.8 Critical CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update April 2018
WeaknessDeserialization of untrusted data (CWE-502)
Published19 Apr 2018
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-09-08 · remediation due 2022-09-29 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · 23 exploits · earliest 2022-09-08.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 26 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2018-04-18.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2018-2628 in VulnCheck (free account), which lists 18 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-09-08
Reported exploitation info.greynoise.io /hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf 2025-02-27
Reported exploitation zscaler.com /resources/industry-reports/non-web-attack-surface-report.pdf 2025-10-20
Exploit reference VulnCheck XDB 5fb56addad69 Exploit type: initial-access 2018-04-18
Exploit reference VulnCheck XDB 9568d7a3210d Exploit type: initial-access 2018-04-18
Exploit reference VulnCheck XDB b7a4c562d6cc Exploit type: initial-access 2018-04-18
Exploit reference VulnCheck XDB d6dc32e5b5af Exploit type: initial-access 2018-04-18
Exploit reference VulnCheck XDB 9bb8a4f5bcd7 Exploit type: initial-access 2018-04-19
IndexArtifactStarsFirst seen
GitHub PoC weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883 2,080 2020-01-15
Nuclei Oracle WebLogic Server Deserialization - Remote Code Execution
Exploit-DB Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) 2018-10-25
Metasploit Oracle Weblogic Server Deserialization RCE (manual rank)
GitHub PoC Some codes for bypassing Oracle WebLogic CVE-2018-2628 patch 114 2018-05-03
Exploit-DB Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit) 2018-08-13
GitHub PoC Weblogic 反序列化漏洞(CVE-2018-2628) 107 2018-06-05
Exploit-DB Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit) 2018-08-13
GitHub PoC CVE-2018-2628 & CVE-2018-2893 78 2018-04-18
Exploit-DB Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution 2018-04-22

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Marshal deserialize rce, is Java Deserialization vulnerability.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Marshal deserialize rce, is Java Deserialization vulnerability

How to mitigate CVE-2018-2628

Apply the fix in Oracle Critical Patch Update April 2018. Until you can, Waratek RASP blocks exploitation with its deserialization rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2018 ↗ CPU 2018-Q2 Oracle Fusion Middleware / WLS Core Components (10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware WLS Core Components 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3 10.3.6.0 · 12.1.3.0 · 12.2.1.2 · 12.2.1.3

Products and versions

1 product, 4 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.2.0 · 12.2.1.3

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** T3, WLS CORE COMPONENTS, NO AUTH REMOTE EXPLOIT **Products:** ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE

References

URLTags
https://www.oracle.com/security-alerts/cpuapr2018.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/103776 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040696 Broken Link, Third Party Advisory, VDB Entry
https://github.com/brianwrf/CVE-2018-2628 Broken Link
https://www.exploit-db.com/exploits/44553/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/45193/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46513/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2628 US Government Resource

Timeline
Published2018-04-19By the CVE Program.
Added to CISA KEV2022-09-08Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2022-09-08Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2026-01-07Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.