WaratekVRT Sign in

CVE-2020-14883 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Severity7.2 High CVSS 3.1 2 scores
Fixed inOracle Critical Patch Update October 2020
Published21 Oct 2020
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 13 citations · honeypot sightings · 6 exploits · earliest 2021-11-03.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 8 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2020-11-09.
  • EPSS 98% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-14883 in VulnCheck (free account), which lists 8 more citations and 1 more exploit reference not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 244 days 2023-11-16 to 2026-08-15
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03
Reported exploitation trendmicro.com /en_us/research/22/i/a-post-exploitation-look-at-coinminers-abusing-weblogic-vulnerab.html 2022-09-14
Reported exploitation techcommunity.microsoft.com /t5/microsoft-defender-for-cloud/initial-access-techniques-in-kubernetes-environments-used-by/ba-p/3697975 2023-01-05
Reported exploitation cisa.gov /news-events/cybersecurity-advisories/aa23-215a 2023-08-03
Reported exploitation microsoft.com /content/dam/microsoft/final/en-us/microsoft-brand/documents/MDDR_FINAL_2023_1004.pdf 2023-10-09
Exploit reference VulnCheck XDB 44c3b7e2464d Exploit type: initial-access 2020-11-11
Exploit reference VulnCheck XDB 0a5d3f5f71c2 Exploit type: initial-access 2023-12-21
Exploit reference VulnCheck XDB c5c6975fb276 Exploit type: initial-access 2023-12-21
Exploit reference VulnCheck XDB deddd47ed62a Exploit type: infoleak 2024-06-07
Exploit reference VulnCheck XDB 8c4e7f81169a Exploit type: initial-access 2025-12-01

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-Exchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/RG-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthorized-RCE/TDOA-V11.7-GetOnlineCookie/VMware-vCenter-GetAnyFile/yongyou-GRP-U8-XXE/Oracle-WebLogic-CVE-2020-14883/Oracle-WebLogic-CVE-2020-14882/Apache-Solr-GetAnyFile/F5-BIG-IP-CVE-2021-22986/Sonicwall-SSL-VPN-RCE/GitLab-Graphql-CNVD-2021-14193/D-Link-DCS-CVE-2020-25078/WLAN-AP-WEA453e-RCE/360TianQing-Unauthorized/360TianQing-SQLinjection/FanWeiOA-V8-SQLinjection/QiZhiBaoLeiJi-AnyUserLogin/QiAnXin-WangKangFirewall-RCE/金山-V8-终端安全系统/NCCloud-SQLinjection/ShowDoc-RCE 1,071 2021-03-11
GitHub PoC [CVE-2020-14882] Oracle WebLogic Server Authenticated Remote Code Execution (RCE) 13 2020-11-09
GitHub PoC Weblogic 身份认证绕过漏洞批量检测脚本 7 2020-11-11
GitHub PoC 用于对WebLogic(10.3.6.0.0 ;12.1.3.0.0 ;12.2.1.3.0; 12.2.1.4.0 ;14.1.1.0.0)进行验证及利用 5 2021-01-25
GitHub PoC oracle weblogic 2024-06-07
GitHub PoC A vulnerability scanner that detects CVE-2020-14883 vulnerabilities. 2021-02-25
Nuclei Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
Metasploit Oracle WebLogic Server Administration Console Handle RCE (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full Process
  • Action available patch rule
  • Review human ARMR file
  • Record active
Decided by An ARMR patch file on disk for this CVE
Finding CVE is covered by a multi-CVE ARMR patch rule

ARMR rule files

1 file

The rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.

CVE-2020-14883.armr patch rule, ARMR 2.6 added 2020-10-30 updated 2026-03-04
Sign in to download

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: - Process Forking

How to mitigate CVE-2020-14883

Apply the fix in Oracle Critical Patch Update October 2020. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.2 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary published
CVSS 2.0 9.0 none AV:N/AC:L/Au:S/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Fusion Middleware / Console (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Console 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

Products and versions

1 product, 5 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

References

URLTags
http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuoct2020.html Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14883 US Government Resource

Timeline
Published2020-10-21By the CVE Program.
ARMR remediation created2020-10-30Earliest commit adding this CVE's ARMR patch or security rule.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2021-11-03Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
ARMR remediation last updated2026-03-04Most recent commit touching this CVE's ARMR patch or security rule.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-10-08Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.