CVE-2020-2801

CRITICAL

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Note: The patch for this issue will address the vulnerability only if the WLS instance is using JDK 1.7.0_191 or later, or JDK 1.8.0_181 or later. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Published: Apr 15, 2020 Modified: Jun 17, 2026

NVD-CWE-noinfo

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (4)

Vendor	Product	Version
oracle	weblogic_server	10.3.6.0.0
oracle	weblogic_server	12.1.3.0.0
oracle	weblogic_server	12.2.1.3.0
oracle	weblogic_server	12.2.1.4.0

GitHub Security Advisory GHSA-r6c9-93g7-fmg3

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...

References (2)

https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 2.57%

Top 16% most likely to be exploited

Threat Score 40 / 100

Data Sources

NVD EPSS GitHub