CVE-2015-4852

CVE-2015-4852 is a Java deserialization flaw (CWE-502) in how Oracle WebLogic Server processes untrusted serialized data involving Apache Commons, which permits remote code execution. An attacker triggers it by sending a crafted serialized object to a WebLogic server over the T3 protocol (typically the default administration listener on port 7001) without authentication. Successful exploitation yields arbitrary code execution on the server under the WebLogic service account, enabling full server compromise, lateral movement, and follow-on activity such as cryptomining or ransomware (CISA has not confirmed ransomware use for this CVE). Any organization running Oracle WebLogic Server is affected, particularly those with the T3 port reachable from the internet. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03, EPSS assigns a 96% probability of exploitation within 30 days, and recent reporting highlights it among vulnerabilities exploited by Chinese state-sponsored hackers and discussed in criminal forums.

What to do: Apply the Oracle-provided WebLogic update per vendor instructions (the October 2015 Critical Patch Update and later include the fix), as required by CISA's KEV listing. Until patched, restrict access to the T3 protocol/port 7001 to trusted hosts via firewall rules or WebLogic connection filters, and hunt for signs of compromise such as unexpected child processes, web shells, or unusual outbound connections.