CVE-2020-14644

CVE-2020-14644 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the Core component of Oracle WebLogic Server, Oracle's widely deployed Java application server within Oracle Fusion Middleware. An unauthenticated attacker with network access to a vulnerable WebLogic server can trigger the flaw by sending crafted requests over the IIOP or T3 protocols (the server's remote-access protocols, a well-known vector for WebLogic takeover bugs), and successful exploitation results in a complete takeover of the WebLogic Server with high impact on confidentiality, integrity and availability. Supported affected versions are 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, and Oracle addressed the flaw in its July 2020 Critical Patch Update. Organizations running these WebLogic releases are affected, especially where the T3/IIOP listeners are reachable from untrusted networks or the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-18, confirming exploitation in the wild, and EPSS assigns a 94.5% probability of exploitation within 30 days (100th percentile), although no public PoC is cataloged.

What to do: Apply Oracle's July 2020 Critical Patch Update (or a later CPU) to WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0, prioritizing internet-facing instances, and inventory your environment for WebLogic servers exposing the T3 and IIOP listeners to untrusted networks. Until patched, restrict access to the T3/IIOP listeners to trusted hosts only; per CISA's KEV required action (added 2024-09-18), apply vendor mitigations or discontinue use of unpatched deployments.