---
title: "WebLogic CVE-2020-2883: T3/IIOP Deserialization RCE"
url: https://erroneo.us/security/briefs/weblogic-cve-2020-2883-t3-iiop-deserialization-rce/
description: "An April 2020 unauthenticated WebLogic RCE over T3/IIOP, exploited weeks after the patch, joined CISA KEV in January 2025. Patch, then block T3."
type: security-brief
section: "Security Digest"
date_published: 2020-04-14
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2020-2883"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# WebLogic CVE-2020-2883: T3/IIOP Deserialization RCE

**Verdict: Check exposure.** Exploited since 2020 and fixed since April 2020; the 2025 KEV listing adds no new campaign, but any WebLogic server with T3 or IIOP reachable from untrusted networks and old patches is still an easy takeover.

- **Who must act:** Owners of WebLogic Server 10.3.6, 12.1.3, 12.2.1.3 or 12.2.1.4 without the April 2020 or later patches, and anyone exposing the T3 or IIOP listener beyond trusted hosts.
- **Who can relax:** Teams that apply Oracle's quarterly patches to WebLogic and block T3 and IIOP at the edge; the bug needs network access to those protocols.
- **Affected:** WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 without the April 2020 Critical Patch Update
- **Fixed:** Oracle Critical Patch Update, April 2020 (Apr 14, 2020); Any later WebLogic patch set update on a supported release
- **CVEs:** CVE-2020-2883
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory WebLogic servers and list applied patches with $ORACLE_HOME/OPatch/opatch lspatches.
2. Apply the current WebLogic patch set update; later T3/IIOP bugs such as CVE-2024-21182 are also in KEV.
3. Plan upgrades off 10.3.6 and 12.1.3; Oracle's July 2024 advisory lists only 12.2.1.4.0 and 14.1.1.0.0 as affected supported versions.
4. Block T3/T3S and IIOP from the internet and untrusted networks, and restrict T3 with a WebLogic connection filter as Oracle advises.
5. If a server exposed T3 while unpatched in 2020 or later, hunt for a foothold before trusting it.

### How to check if you are affected

- Check firewall and NetFlow logs for inbound connections from untrusted sources to the WebLogic listen port (often 7001) that negotiate T3 or IIOP.
- Look in EDR telemetry for the WebLogic Java process spawning sh, bash, cmd.exe or powershell.exe.
- Review the domain for unknown admin users, unexpected deployments and new files in server tmp or autodeploy folders.
- Watch for unexplained CPU load and outbound connections from WebLogic hosts.

## What happened

On April 14, 2020, Oracle's [April 2020 Critical Patch Update](https://www.oracle.com/security-alerts/cpuapr2020.html) fixed CVE-2020-2883 in WebLogic Server's Core component. Oracle rated it CVSS 3.0 9.8. It is remotely exploitable without authentication over the IIOP and T3 protocols, and successful attacks can take over the server. Several researchers reported it independently. Quynh Le of VNPT ISC sent two variants through the Zero Day Initiative, [ZDI-20-504](https://www.zerodayinitiative.com/advisories/ZDI-20-504/) and [ZDI-20-570](https://www.zerodayinitiative.com/advisories/ZDI-20-570/). ZDI says the flaw sits in the Oracle Coherence library, which does not properly validate data before deserializing it.

The bug bypassed Oracle's January 2020 fix for CVE-2020-2555, according to [Tenable](https://www.tenable.com/blog/cve-2020-2883-oracle-weblogic-deserialization-vulnerability-exploited-in-the-wild). That made public exploit code easy to adapt. Attacks followed within weeks. On April 30, Oracle urged customers to apply the patches "without delay" after reports of exploitation attempts. On May 1, CISA [warned](https://www.cisa.gov/news-events/alerts/2020/05/01/unpatched-oracle-weblogic-servers-vulnerable-cve-2020-2883) that "malicious cyber actors are now known to be targeting unpatched servers."

The [KEV listing](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883) came almost five years later. CISA [added it](https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-adds-three-known-exploited-vulnerabilities-catalog) on January 7, 2025, alongside two Mitel MiCollab bugs, with a January 28 deadline. CISA gave no new evidence. [Censys](https://censys.com/cve-2020-2883/) found "no recent reports" of a renewed surge and called the listing likely "a precautionary measure." No public source has described a 2025 campaign as of Oct 23, 2026.

## Who is affected

WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 without the April 2020 patches, per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2020-2883) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-2883). The attacker needs network access to the T3 or IIOP listener. Tenable notes that other software embedding Coherence may also be exposed where it deserializes untrusted data.

## Do you really need to act?

Only if you run WebLogic. CISA rates the bug "automatable," and it has public exploits, so an exposed, unpatched server is easy prey. In January 2025, Censys counted 236 exposed WebLogic servers it could fingerprint, about two-thirds of them in China. That is a small visible footprint. Many more sit inside corporate networks.

The verdict is check exposure. Being patched for 2020 is not enough. CISA later added newer unauthenticated T3/IIOP flaws, including CVE-2020-14644 in September 2024 and CVE-2024-21182 in June 2026. Oracle's July 2024 advisory for CVE-2024-21182 names only 12.2.1.4.0 and 14.1.1.0.0 as affected supported versions, so plan to retire 10.3.6 and 12.1.3.

## What to do now

1. Inventory WebLogic servers. Run `$ORACLE_HOME/OPatch/opatch lspatches` on each, or `java weblogic.version` after sourcing `setWLSEnv.sh`.
2. Apply the current WebLogic patch set update, not just April 2020.
3. Plan upgrades off 10.3.6 and 12.1.3.
4. Block T3/T3S and IIOP from the internet and untrusted networks. Use a WebLogic connection filter, and disable IIOP if nothing uses it.
5. If a server exposed T3 while unpatched, run the checks below.

## How to tell if you were hit

- Check firewall logs for inbound connections from untrusted sources to WebLogic listen ports, often 7001.
- Look for the WebLogic Java process spawning `sh`, `bash`, `cmd.exe` or `powershell.exe`.
- Review the domain for unknown admin users, unexpected deployments and new files in server `tmp` or `autodeploy` folders.
- Investigate unexplained CPU load or outbound connections from WebLogic hosts.

## Timeline

- Feb 12, 2020 — ZDI reports the first variant to Oracle.
- Apr 14, 2020 — Oracle ships the fix in the April CPU.
- Apr 30, 2020 — Oracle warns of exploitation attempts.
- May 1, 2020 — CISA warns attackers are targeting unpatched servers.
- Jan 7, 2025 — CISA adds CVE-2020-2883 to KEV.

## Sources

1. [Oracle — Critical Patch Update Advisory, April 2020](https://www.oracle.com/security-alerts/cpuapr2020.html)
2. [CVE record — CVE-2020-2883](https://www.cve.org/CVERecord?id=CVE-2020-2883)
3. [NVD — CVE-2020-2883](https://nvd.nist.gov/vuln/detail/CVE-2020-2883)
4. [Zero Day Initiative — ZDI-20-570: Oracle WebLogic Server T3 Protocol Deserialization of Untrusted Data RCE](https://www.zerodayinitiative.com/advisories/ZDI-20-570/)
5. [Zero Day Initiative — ZDI-20-504: Oracle WebLogic Server T3 Protocol Deserialization of Untrusted Data RCE](https://www.zerodayinitiative.com/advisories/ZDI-20-504/)
6. [CISA — Known Exploited Vulnerabilities: CVE-2020-2883](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2883)
7. [CISA — Unpatched Oracle WebLogic Servers Vulnerable to CVE-2020-2883 (May 1, 2020)](https://www.cisa.gov/news-events/alerts/2020/05/01/unpatched-oracle-weblogic-servers-vulnerable-cve-2020-2883)
8. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jan 7, 2025)](https://www.cisa.gov/news-events/alerts/2025/01/07/cisa-adds-three-known-exploited-vulnerabilities-catalog)
9. [Tenable — CVE-2020-2883: Oracle WebLogic Deserialization Vulnerability Exploited in the Wild](https://www.tenable.com/blog/cve-2020-2883-oracle-weblogic-deserialization-vulnerability-exploited-in-the-wild)
10. [Censys — Oracle WebLogic Vulnerability Added to CISA KEV [CVE-2020-2883]](https://censys.com/cve-2020-2883/)

---
Source page: https://erroneo.us/security/briefs/weblogic-cve-2020-2883-t3-iiop-deserialization-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt