WaratekVRT Sign in

CVE-2020-2546 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions10.3.6.0.0, 12.1.3.0.0
Severity9.8 Critical CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update January 2020
Published15 Jan 2020
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Application Container - JavaEE). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2020-03-02.
  • EPSS 5.2% chance in 30 days
IndexArtifactStarsFirst seen
GitHub PoC CVE-2020-2546，CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic T3 payload exploit poc python3, 133 2020-03-02

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the Marshal RCE rule, ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule, ARMR Process rule

How to mitigate CVE-2020-2546

Apply the fix in Oracle Critical Patch Update January 2020. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2020 ↗ CPU 2020-Q1 Oracle Fusion Middleware / Application Container - JavaEE (10.3.6.0.0, 12.1.3.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Application Container - JavaEE 10.3.6.0.0, 12.1.3.0.0 10.3.6.0.0 · 12.1.3.0.0

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0

References

URLTags
https://www.oracle.com/security-alerts/cpujan2020.html Patch, Vendor Advisory

Timeline
Published2020-01-15By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.