CVE-2020-2555

Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 contain a deserialization flaw (CWE-502) in the Caching, CacheStore and Invocation components, rated 9.8 (critical). An unauthenticated attacker with network access to the T3 protocol — the listener typically exposed by Oracle WebLogic Server, which bundles Coherence — can send a crafted serialized payload and take over Coherence, effectively achieving remote code execution in the hosting Java process with no credentials or user interaction required. Beyond standalone Coherence, the flaw affects the Oracle Fusion Middleware products that bundle it, including Access Manager, WebCenter Portal, Commerce Platform, Rapid Planning and others. Exploitation is confirmed in the wild: CISA added it to the KEV catalog on 2021-11-03, EPSS estimates a ~97% probability of exploitation within 30 days, public PoCs and exploit write-ups exist, and related reporting flags it among vulnerabilities heavily used by Chinese state-sponsored hackers.

What to do: Apply the Coherence fixes from Oracle's January 2020 Critical Patch Update (or later) for Coherence 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 and for every listed product that embeds Coherence, prioritizing WebLogic-based deployments given active exploitation and the 9.8 CVSS. Until patched, restrict T3/T3S access to trusted networks and remove direct internet exposure of WebLogic listener ports, and keep this in your KEV/EPSS-driven remediation queue; hunt for unexpected code execution or outbound connections originating from T3 listeners.