CVE-2020-14750

CVE-2020-14750 is a critical vulnerability in the Console component of Oracle WebLogic Server (Oracle Fusion Middleware), functioning as a bypass of the earlier fix for the widely exploited CVE-2020-14882. An unauthenticated attacker with network access over HTTP can trigger it simply by sending crafted requests to the web administration console, with no credentials or user interaction required. Successful exploitation results in full takeover of the WebLogic Server, yielding high impact to confidentiality, integrity and availability (CVSS 3.1 score of 9.8). All supported WebLogic Server versions are affected — 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 — particularly deployments whose admin console is reachable from the internet. Exploitation is confirmed in the wild: the flaw is in CISA's KEV catalog (added 2021-11-03), carries a 99.3% EPSS, and multiple botnets have been observed exploiting it, with reports of access brokers selling compromised-server access to ransomware operators.

What to do: Apply Oracle's emergency/out-of-cycle patch for CVE-2020-14750 or any later Critical Patch Update on all affected WebLogic versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0), per vendor instructions. Until patched, restrict HTTP access to the WebLogic admin console to trusted networks and prioritize remediating internet-facing consoles. Hunt for signs of exploitation, since multiple botnets are actively scanning for and exploiting this flaw.