WaratekVRT Sign in

CVE-2021-2135 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Severity9.8 Critical CVSS 3.1 2 scores
Fixed inOracle Critical Patch Update April 2021
Published22 Apr 2021
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 1 citation · earliest 2021-10-07.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed Published artifacts you can open, in Nuclei.
  • EPSS 8.4% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-2135 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation vblocalhost.com /uploads/VB2021-50.pdf 2021-10-07
IndexArtifactStarsFirst seen
Nuclei Oracle WebLogic Server - Remote Code Execution

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the Marshal RCE rule, ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule, ARMR Process rule

How to mitigate CVE-2021-2135

Apply the fix in Oracle Critical Patch Update April 2021. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle Fusion Middleware / Coherence Container (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Coherence Container 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

Products and versions

1 product, 3 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

References

URLTags
https://www.oracle.com/security-alerts/cpuapr2021.html Patch, Vendor Advisory

Timeline
Published2021-04-22By the CVE Program.
VulnCheck KEV: earliest evidence2021-10-07Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.