WaratekVRT Sign in

CVE-2019-2725 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions2.3.0
Severity9.8 Critical CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update July 2019
WeaknessCWE-74
Published26 Apr 2019
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-01-10 · remediation due 2022-07-10 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 41 citations · honeypot sightings · 22 exploits · earliest 2019-04-30.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 23 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2018-09-13.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2019-2725 in VulnCheck (free account), which lists 36 more citations and 17 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 959 days 2023-11-14 to 2026-11-12
Reported exploitation blog.talosintelligence.com /2019/04/sodinokibi-ransomware-exploits-weblogic.html 2019-04-30
Reported exploitation threatpost.com /new-sodinokibi-ransomware-exploits-critical-oracle-weblogic-flaw/144233 2019-04-30
Reported exploitation digital.nhs.uk /cyber-alerts/2019/cc-3044 2019-05-01
Reported exploitation cyber.nj.gov /threat-center/threat-profiles/ransomware-variants/sodinokibi 2019-05-02
Reported exploitation threatpost.com /oracle-weblogic-exploit-gandcrab-xmrig/144419 2019-05-06
Exploit reference VulnCheck XDB fde868f2088b Exploit type: initial-access 2019-05-05
Exploit reference VulnCheck XDB 7c3b3b925cc4 Exploit type: initial-access 2019-05-10
Exploit reference VulnCheck XDB ba53dc77acf6 Exploit type: initial-access 2019-05-14
Exploit reference VulnCheck XDB 78cfc32167c4 Exploit type: initial-access 2019-05-29
Exploit reference VulnCheck XDB e2c5b5fb0f5b Exploit type: initial-access 2019-06-11
IndexArtifactStarsFirst seen
GitHub PoC Java反序列化漏洞利用工具V1.0 Java反序列化相关漏洞的检查工具，采用JDK 1.8+NetBeans8.2开发，软件运行必须安装JDK 1.8或者以上版本。 支持：weblogic xml反序列化漏洞 CVE-2017-10271/CNVD-C-2019-48814/CVE-2019-2725检查。 517 2018-09-13
Nuclei Oracle WebLogic Server - Remote Command Execution
Exploit-DB Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit) 2019-05-08
Metasploit Oracle Weblogic Server Deserialization RCE - AsyncResponseService (excellent rank)
GitHub PoC CVE-2019-2725 命令回显 432 2019-05-29
Exploit-DB Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit) 2019-05-08
GitHub PoC CVE-2019-2725poc汇总 更新绕过CVE-2017-10271补丁POC 105 2019-04-25
Exploit-DB Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution 2019-04-30
GitHub PoC Weblogic CVE-2019-2725 CVE-2019-2729 Getshell 命令执行 70 2019-06-24
GitHub PoC WebLogic Insecure Deserialization - CVE-2019-2725 payload builder & exploit 52 2019-08-23

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the Marshal RCE rule, ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule, ARMR Process rule

XMLDecoder (WSAT async) RCE. The Marshal deserialize(java)+rce() rule intercepts it: the ARMR agent hooks java.beans.XMLDecoder.readObject() into the same deserialization restricted environment as native serialization, and rce() blocks the Runtime.exec/ProcessBuilder.start the decoded gadget triggers. The standalone ARMR Process rule is a second, independent layer. (Corrected 2026-06: an earlier note here read "Marshal does not intercept XMLDecoder" — disproved by the agent source, where the XMLDecoder hook has fed the deserial/marshal rule since 2019. Category is deserialization, not command-injection.)

How to mitigate CVE-2019-2725

Apply the fix in Oracle Critical Patch Update July 2019. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H secalert_us@oracle.com Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2020 ↗ CPU 2020-Q1 Oracle Systems / Application Server (Oracle WebLogic Server) (8.5)
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Sun Systems Products Suite / Application Server (WebLogic) (2.3.0)
Oracle Sun Systems Products Suite / Application Server (WebLogic) (6.2)
Oracle Supply Chain Products Suite / Application Server (Oracle WebLogic Server) (9.3.3, 9.3.4, 9.3.5)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Sun Systems Products Suite Application Server (WebLogic) 2.3.0 2.3.0 · 6.2
Oracle Supply Chain Products Suite Application Server (Oracle WebLogic Server) 9.3.3, 9.3.4, 9.3.5 9.3.3 · 9.3.4 · 9.3.5
Oracle Systems Application Server (Oracle WebLogic Server) 8.5 8.5

Products and versions

8 products, 18 version entries
SourceVendorProductSchemeAffected versions
nvd oracle agile product lifecycle management generic 9.3.3 · 9.3.4 · 9.3.5
nvd oracle communications converged application server generic 5.1 · 7.0 · 7.1
nvd oracle peoplesoft enterprise peopletools generic 8.56 · 8.57 · 8.58
nvd oracle storagetek tape analytics sw tool generic 2.3
nvd oracle tape library acsls generic 8.5
nvd oracle tape virtual storage manager gui generic 6.2
nvd oracle vm virtualbox generic 5.2.36 · ＜ 5.2.36 · ≥ 6.0.0 and ＜ 6.0.16 · ≥ 6.1.0 and ＜ 6.1.2
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0

References

URLTags
http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html Third Party Advisory, VDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html Patch, Vendor Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/108074 Broken Link
https://support.f5.com/csp/article/K90059138 Third Party Advisory
https://www.exploit-db.com/exploits/46780/ Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725 US Government Resource

Timeline
Published2019-04-26By the CVE Program.
VulnCheck KEV: earliest evidence2019-04-30Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-01-10Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-10-01NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-12Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.