CVE-2020-2551

CRITICAL CISA KEV

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Published: Jan 15, 2020 Modified: Jun 17, 2026

NVD-CWE-noinfo

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (4)

Vendor	Product	Version
oracle	weblogic_server	10.3.6.0.0
oracle	weblogic_server	12.1.3.0.0
oracle	weblogic_server	12.2.1.3.0
oracle	weblogic_server	12.2.1.4.0

GitHub Security Advisory GHSA-85qx-3cmc-hcq4

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS...

References (3)

https://www.oracle.com/security-alerts/cpujan2020.html Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpujan2020.html Patch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2551 US Government Resource

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 93.17%

Top 0% most likely to be exploited

Threat Score 97.2 / 100

CISA Known Exploited

Date Added: 2023-11-16

Due Date: 2023-12-07

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Data Sources

NVD CISA KEV EPSS GitHub