CVE-2020-2883

CRITICAL CISA KEV

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Published: Apr 15, 2020 Modified: Jun 17, 2026

NVD-CWE-noinfo

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (4)

Vendor	Product	Version
oracle	weblogic_server	10.3.6.0.0
oracle	weblogic_server	12.1.3.0.0
oracle	weblogic_server	12.2.1.3.0
oracle	weblogic_server	12.2.1.4.0

GitHub Security Advisory GHSA-9x8q-p3qp-r24w

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)...

References (9)

http://packetstormsecurity.com/files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.html Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-504/ Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-570/ Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157950/WebLogic-Server-Deserialization-Remote-Code-Execution.html Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2020.html Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-504/ Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-20-570/ Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883 US Government Resource

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 94.93%

Top 0% most likely to be exploited

Threat Score 97.7 / 100

CISA Known Exploited

Date Added: 2025-01-07

Due Date: 2025-01-28

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Data Sources

NVD CISA KEV EPSS GitHub