WaratekVRT Sign in

CVE-2022-21306 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Severity9.8 Critical CVSS 3.1 2 scores
Fixed inOracle Critical Patch Update January 2022
Published19 Jan 2022
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. The 1 repository below are public GitHub repositories with fewer than 5 stars.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 1 indexed, none at 5+ stars
  • EPSS 4.4% chance in 30 days

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC POC，EXP，chatGPT for me，只能给一些思路，全部不可用 1 2023-04-07

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: ARMR Process rule

How to mitigate CVE-2022-21306

Apply the fix in Oracle Critical Patch Update January 2022. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H secalert_us@oracle.com Secondary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2022 ↗ CPU 2022-Q1 Oracle Fusion Middleware / Core (12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Core 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

Products and versions

1 product, 4 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0

References

URLTags
https://www.oracle.com/security-alerts/cpujan2022.html Vendor Advisory

Timeline
Published2022-01-19By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.