WebLogic CVE-2020-2883: T3/IIOP Deserialization RCE

What to do

1. Inventory WebLogic servers and list applied patches with $ORACLE_HOME/OPatch/opatch lspatches.
2. Apply the current WebLogic patch set update; later T3/IIOP bugs such as CVE-2024-21182 are also in KEV.
3. Plan upgrades off 10.3.6 and 12.1.3; Oracle's July 2024 advisory lists only 12.2.1.4.0 and 14.1.1.0.0 as affected supported versions.
4. Block T3/T3S and IIOP from the internet and untrusted networks, and restrict T3 with a WebLogic connection filter as Oracle advises.
5. If a server exposed T3 while unpatched in 2020 or later, hunt for a foothold before trusting it.

How to check if you are affected or compromised

• Check firewall and NetFlow logs for inbound connections from untrusted sources to the WebLogic listen port (often 7001) that negotiate T3 or IIOP.
• Look in EDR telemetry for the WebLogic Java process spawning sh, bash, cmd.exe or powershell.exe.
• Review the domain for unknown admin users, unexpected deployments and new files in server tmp or autodeploy folders.
• Watch for unexplained CPU load and outbound connections from WebLogic hosts.

What happened#

On April 14, 2020, Oracle's April 2020 Critical Patch Update fixed CVE-2020-2883 in WebLogic Server's Core component. Oracle rated it CVSS 3.0 9.8. It is remotely exploitable without authentication over the IIOP and T3 protocols, and successful attacks can take over the server. Several researchers reported it independently. Quynh Le of VNPT ISC sent two variants through the Zero Day Initiative, ZDI-20-504 and ZDI-20-570. ZDI says the flaw sits in the Oracle Coherence library, which does not properly validate data before deserializing it.

The bug bypassed Oracle's January 2020 fix for CVE-2020-2555, according to Tenable. That made public exploit code easy to adapt. Attacks followed within weeks. On April 30, Oracle urged customers to apply the patches "without delay" after reports of exploitation attempts. On May 1, CISA warned that "malicious cyber actors are now known to be targeting unpatched servers."

The KEV listing came almost five years later. CISA added it on January 7, 2025, alongside two Mitel MiCollab bugs, with a January 28 deadline. CISA gave no new evidence. Censys found "no recent reports" of a renewed surge and called the listing likely "a precautionary measure." No public source has described a 2025 campaign as of Oct 23, 2026.

Who is affected#

WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 without the April 2020 patches, per the CVE record and NVD. The attacker needs network access to the T3 or IIOP listener. Tenable notes that other software embedding Coherence may also be exposed where it deserializes untrusted data.

Do you really need to act?#

Only if you run WebLogic. CISA rates the bug "automatable," and it has public exploits, so an exposed, unpatched server is easy prey. In January 2025, Censys counted 236 exposed WebLogic servers it could fingerprint, about two-thirds of them in China. That is a small visible footprint. Many more sit inside corporate networks.

The verdict is check exposure. Being patched for 2020 is not enough. CISA later added newer unauthenticated T3/IIOP flaws, including CVE-2020-14644 in September 2024 and CVE-2024-21182 in June 2026. Oracle's July 2024 advisory for CVE-2024-21182 names only 12.2.1.4.0 and 14.1.1.0.0 as affected supported versions, so plan to retire 10.3.6 and 12.1.3.

What to do now#

1. Inventory WebLogic servers. Run $ORACLE_HOME/OPatch/opatch lspatches on each, or java weblogic.version after sourcing setWLSEnv.sh.
2. Apply the current WebLogic patch set update, not just April 2020.
3. Plan upgrades off 10.3.6 and 12.1.3.
4. Block T3/T3S and IIOP from the internet and untrusted networks. Use a WebLogic connection filter, and disable IIOP if nothing uses it.
5. If a server exposed T3 while unpatched, run the checks below.

How to tell if you were hit#

• Check firewall logs for inbound connections from untrusted sources to WebLogic listen ports, often 7001.
• Look for the WebLogic Java process spawning sh, bash, cmd.exe or powershell.exe.
• Review the domain for unknown admin users, unexpected deployments and new files in server tmp or autodeploy folders.
• Investigate unexplained CPU load or outbound connections from WebLogic hosts.

Timeline#

• Feb 12, 2020 — ZDI reports the first variant to Oracle.
• Apr 14, 2020 — Oracle ships the fix in the April CPU.
• Apr 30, 2020 — Oracle warns of exploitation attempts.
• May 1, 2020 — CISA warns attackers are targeting unpatched servers.
• Jan 7, 2025 — CISA adds CVE-2020-2883 to KEV.

Vulnerability records

• CVE-2020-2883 · KEV 2025-01-07 · Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Oracle — Critical Patch Update Advisory, April 2020 oracle.com
2. CVE record — CVE-2020-2883 cve.org
3. NVD — CVE-2020-2883 nvd.nist.gov
4. Zero Day Initiative — ZDI-20-570: Oracle WebLogic Server T3 Protocol Deserialization of Untrusted Data RCE zerodayinitiative.com
5. Zero Day Initiative — ZDI-20-504: Oracle WebLogic Server T3 Protocol Deserialization of Untrusted Data RCE zerodayinitiative.com
6. CISA — Known Exploited Vulnerabilities: CVE-2020-2883 cisa.gov
7. CISA — Unpatched Oracle WebLogic Servers Vulnerable to CVE-2020-2883 (May 1, 2020) cisa.gov
8. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jan 7, 2025) cisa.gov
9. Tenable — CVE-2020-2883: Oracle WebLogic Deserialization Vulnerability Exploited in the Wild tenable.com
10. Censys — Oracle WebLogic Vulnerability Added to CISA KEV [CVE-2020-2883] censys.com