WaratekVRT Sign in

CVE-2018-3252 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions10.3.6.0, 12.1.3.0, 12.2.1.3
Severity9.8 Critical CVSS 3.0 2 scores
Fixed inOracle Critical Patch Update October 2018
Published17 Oct 2018
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC; first seen 2018-10-25.
  • EPSS 30% chance in 30 days A model's forecast, not a report of exploitation. Higher than 98% of all scored CVEs.
IndexArtifactStarsFirst seen
GitHub PoC CVE-2018-3252-PoC 73 2018-12-06
GitHub PoC go-spider/CVE-2018-3252 18 2018-12-04
GitHub PoC Weblogic-CVE-2018-3252 8 2018-10-25

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the Marshal RCE rule, ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule, ARMR Process rule

How to mitigate CVE-2018-3252

Apply the fix in Oracle Critical Patch Update October 2018. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2018 ↗ CPU 2018-Q4 Oracle Fusion Middleware / WLS Core Components (10.3.6.0, 12.1.3.0, 12.2.1.3)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware WLS Core Components 10.3.6.0, 12.1.3.0, 12.2.1.3 10.3.6.0 · 12.1.3.0 · 12.2.1.3

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/105613 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041896 Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201908-24

Timeline
Published2018-10-17By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.