What’s Vulnerable › Vulnerabilities
CVE-2020-14644: Oracle WebLogic Server Remote Code Execution Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2024-09-18
- EPSS: 94.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-07-15 · updated 2026-06-17
Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Summary
CVE-2020-14644 is a critical remote code execution flaw in the Core component of Oracle WebLogic Server, exploitable without authentication by an attacker with network access via IIOP or T3. Successful exploitation can fully take over the server, affecting confidentiality, integrity, and availability (CVSS 9.8). Oracle WebLogic Server versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, a public exploit exists, and EPSS estimates a 94.5% chance of exploitation within 30 days. Apply the vendor's patches or mitigations immediately, or discontinue use of the product if mitigations are unavailable.
CVE-2020-14644 ثغرة حرجة لتنفيذ التعليمات البرمجية عن بُعد في مكوّن Core ضمن Oracle WebLogic Server، ويمكن استغلالها دون مصادقة من قِبل مهاجم لديه وصول شبكي عبر IIOP أو T3. يؤدي الاستغلال الناجح إلى السيطرة الكاملة على الخادم مع تأثير على السرية والسلامة والتوافر (CVSS 9.8). تتأثر الإصدارات 12.2.1.3.0 و12.2.1.4.0 و14.1.1.0.0 من Oracle WebLogic Server. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، ويتوفر استغلال عام، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 94.5%. طبّق تحديثات أو تخفيفات المورّد فوراً، أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات.
Affected products
- Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
References
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14644
Get alerted when CVE-2020-14644 or the next vulnerability affects your stack