WaratekVRT Sign in

CVE-2020-2555 Oracle Coherence

Affected softwareOracle Coherence
Affected versions3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
Severity9.8 Critical CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update January 2020
WeaknessDeserialization of untrusted data (CWE-502)
Published15 Jan 2020
Updated13 Nov 2026

Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2022-05-03 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 5 citations · 10 exploits · earliest 2020-10-20.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 8 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit; first seen 2020-03-06.
  • EPSS 97% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2020-2555 in VulnCheck (free account), which lists 5 more exploit references not shown here.

EvidenceSourceDetailDate
Reported exploitation cisa.gov /news-events/cybersecurity-advisories/aa20-275a 2020-10-20
Reported exploitation media.defense.gov /2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF 2020-10-20
Reported exploitation us-cert.cisa.gov /ncas/alerts/aa20-275a 2020-10-20
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03
Reported exploitation securin.io /wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf 2023-08-08
Exploit reference VulnCheck XDB 2c95cddac1b5 Exploit type: initial-access 2020-03-07
Exploit reference VulnCheck XDB 0922d65f699e Exploit type: initial-access 2020-04-01
Exploit reference VulnCheck XDB 322326255843 Exploit type: initial-access 2020-05-06
Exploit reference VulnCheck XDB 1e73baaf61d1 Exploit type: initial-access 2020-05-16
Exploit reference VulnCheck XDB 235a5c344d3f Exploit type: initial-access 2020-07-22

2 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE 177 2020-03-07
GitHub PoC CVE-2020-2555 Python POC 45 2020-03-06
GitHub PoC CVE-2020-2555 14 2020-03-10
GitHub PoC Hu3sky/CVE-2020-2555 3 2020-03-06
GitHub PoC poc for CVE-2020-2555 1 2021-11-15
Exploit-DB WebLogic Server - Deserialization RCE - BadAttributeValueExpException (Metasploit) 2020-05-22
Exploit-DB Oracle WebLogic Server 12.2.1.4.0 - Remote Code Execution 2020-04-14
Metasploit WebLogic Server Deserialization RCE - BadAttributeValueExpException (normal rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

  • Protection full
  • Action available security rule
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Protected by Waratek.

Waratek research note

written 2026-11-13

A Waratek engineer reviewed this CVE and set the status above. No notes were recorded with it.

How to mitigate CVE-2020-2555

Apply the fix in Oracle Critical Patch Update January 2020. Until you can, Waratek RASP blocks exploitation with a security rule that blocks this kind of attack. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Commerce / Dynamo Application Framework (Coherence) (11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2)
Oracle Fusion Middleware / Installation Component (Oracle Coherence) (11.1.2.3.0)
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Utilities Applications / General (Oracle Coherence) (4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0)
Oracle Critical Patch Update October 2020 ↗ CPU 2020-Q4 Oracle Communications / IDIH (Oracle Coherence) (IDIH: 8.0.0-8.2.2)
Oracle Fusion Middleware / Security Framework (Oracle Coherence) (12.2.1.3.0, 12.2.1.4.0)
Oracle Health Sciences Applications / Database Module (Oracle Coherence) (7.0.1)
Oracle Critical Patch Update July 2020 ↗ CPU 2020-Q3 Oracle Retail Applications / Application Core (Coherence) (15.0, 16.0)
Oracle Supply Chain / Middle Tier (12.1, 12.2)
Oracle Critical Patch Update January 2020 ↗ CPU 2020-Q1 Oracle Fusion Middleware / Caching,CacheStore,Invocation (3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Commerce Dynamo Application Framework (Coherence) 11.0.0, 11.1.0, 11.2.0, 11.3.0-11.3.2 11.0.0 · 11.1.0 · 11.2.0
Oracle Communications IDIH (Oracle Coherence) IDIH: 8.0.0-8.2.2
Oracle Fusion Middleware Caching,CacheStore,Invocation 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 3.7.1.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Installation Component (Oracle Coherence) 11.1.2.3.0 11.1.2.3.0
Oracle Fusion Middleware Security Framework (Oracle Coherence) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Health Sciences Applications Database Module (Oracle Coherence) 7.0.1 7.0.1
Oracle Retail Applications Application Core (Coherence) 15.0, 16.0 15.0 · 16.0
Oracle Supply Chain Middle Tier 12.1, 12.2 12.1 · 12.2
Oracle Utilities Applications General (Oracle Coherence) 4.2.0.2.0, 4.2.0.3.0, 4.3.0.1.0-4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0 4.2.0.2.0 · 4.2.0.3.0 · 4.4.0.0.0 · 4.4.0.2.0

Products and versions

9 products, 22 version entries
SourceVendorProductSchemeAffected versions
nvd oracle access manager generic 11.1.2.3.0
nvd oracle coherence generic 3.7.1.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0
nvd oracle commerce platform generic 11.0.0 · 11.1.0 · 11.2.0 · ≥ 11.3.0 and ≤ 11.3.2
nvd oracle communications diameter signaling router generic ≥ 8.0.0 and ≤ 8.2.2
nvd oracle healthcare data repository generic 7.0.1
nvd oracle rapid planning generic 12.1 · 12.2
nvd oracle retail assortment planning generic 15.0 · 16.0
nvd oracle utilities framework generic 4.2.0.2.0 · 4.2.0.3.0 · ≥ 4.3.0.1.0 and ≤ 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0
nvd oracle webcenter portal generic 12.2.1.3.0 · 12.2.1.4.0

References

URLTags
http://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpujan2020.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2020.html Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.html Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2555 US Government Resource

Timeline
Published2020-01-15By the CVE Program.
VulnCheck KEV: earliest evidence2020-10-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2023-12-21Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.