WaratekVRT Sign in

CVE-2023-22069 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions12.2.1.4.0, 14.1.1.0.0
Severity9.8 Critical CVSS 3.1
Fixed inOracle Critical Patch Update October 2023
WeaknessMissing authentication (CWE-306)
Published17 Oct 2023
Updated17 Jun 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploitation status

Exploited

Real-world exploitation reported by VulnCheck KEV. CISA has not confirmed it.
  • CISA KEV not listed
  • VulnCheck KEV listed Exploitation reported in the wild. 2 citations · earliest 2024-10-08.
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.87% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2023-22069 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation zscaler.com /blogs/security-research/shining-light-dark-angels-ransomware-group 2024-10-08
Reported exploitation zscaler.com /resources/industry-reports/threatlabz-2025-ransomware-analysis.pdf 2025-07-29

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection unknown
  • Action not assessed
  • Review automated Upstream data
  • Record active
Decided by Somebody exploiting this CVE (a CISA or VulnCheck KEV listing, or a CISA verdict of active exploitation), with no fix, source code or PoC to build a rule from
Finding VulnCheck KEV reports exploitation (2 written report(s), earliest 2024-10-08). VRT found no upstream fix and no open-source Maven package, and no PoC is published, so there is nothing to build an ARMR rule from yet. No rule exists and none is planned. Nobody has checked whether an existing ARMR rule already blocks it.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2023 ↗ CPU 2023-Q4 Oracle Fusion Middleware / Core (12.2.1.4.0, 14.1.1.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware Core 12.2.1.4.0, 14.1.1.0.0 12.2.1.4.0 · 14.1.1.0.0

Products and versions

1 product, 2 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 12.2.1.4.0 · 14.1.1.0.0

References

URLTags
https://www.oracle.com/security-alerts/cpuoct2023.html Patch, Vendor Advisory

Timeline
Published2023-10-17By the CVE Program.
VulnCheck KEV: earliest evidence2024-10-08Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2025-07-29Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.