CVE-2023-21839 Oracle WebLogic Server
| Affected software | Oracle WebLogic Server |
|---|---|
| Affected versions | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 |
| Severity | 7.5 High CVSS 3.1 |
| Fixed in | Oracle Critical Patch Update January 2023 |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 18 Jan 2023 |
| Updated | 13 Nov 2026 |
Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CWE-306 · Missing authentication
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2023-05-01 · remediation due 2023-05-22 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 8 citations · 9 exploits · earliest 2023-05-01.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
- Indexed PoC 9 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2023-02-21.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-21839 in VulnCheck (free account), which lists 3 more citations and 4 more exploit references not shown here.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | DXask88MA/Weblogic-CVE-2023-21839 | 242 | 2023-02-21 |
| GitHub PoC | Weblogic CVE-2023-21839 RCE (无需Java依赖一键RCE) | 118 | 2023-02-24 |
| GitHub PoC | CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 | 61 | 2024-02-06 |
| GitHub PoC | CVE-2023-21839工具 | 26 | 2023-03-11 |
| GitHub PoC | CVE-2023-21839 Python版本 | 19 | 2023-04-15 |
| GitHub PoC | Reproducible Docker lab for CVE-2024-21182 — Oracle WebLogic T3/IIOP OpaqueReference JNDI injection → unauthenticated RCE (CVE-2023-21839 patch-bypass family). One-command validate.sh. | 3 | 2026-06-02 |
| GitHub PoC | A testing tool for CobaltStrike-RCE:CVE-2022-39197; Weblogic-RCE:CVE-2023-21839; MinIO:CVE-2023-28432 | 2 | 2023-12-03 |
| Nuclei | Oracle WebLogic Server - Unauthorized Access | ||
| Metasploit | Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization (excellent rank) |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
JNDI injection (not native deserialization); the Process rule blocks the RCE payload.
How to mitigate CVE-2023-21839
Apply the fix in Oracle Critical Patch Update January 2023. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Security Patch Update August 2026 ↗ | CSPU | 2026-Q3 | Oracle Fusion Middleware / Core (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Fusion Middleware / Core (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Fusion Middleware | Core | 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 · 14.1.2.0.0 · 15.1.1.0.0 |
Products and versions
1 product, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | oracle | weblogic server | generic | 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
References
| URL | Tags |
|---|---|
| https://www.oracle.com/security-alerts/cpujan2023.html | |
| http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html | Exploit, Third Party Advisory, VDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839 | US Government Resource |
Timeline
Timeline
| Published | 2023-01-18 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2023-05-01 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2023-05-01 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| VulnCheck KEV: latest evidence | 2026-06-02 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |