CVE-2023-21839

Oracle WebLogic Server contains a vulnerability that allows an unauthenticated attacker with network access to the server's T3 or IIOP endpoints to fully compromise the WebLogic instance (widely characterized as remote code execution). It is triggered simply by sending crafted T3 or IIOP protocol requests to a listening WebLogic server, requiring no credentials or user interaction. An attacker who succeeds gains the ability to run code on the application server host, providing a foothold in the application tier that can be used for lateral movement; CISA notes that ransomware use is currently unknown. Any organization running affected Oracle WebLogic Server versions is exposed, particularly where the T3/IIOP listeners are reachable from the internet or from less-trusted network zones. The flaw is being exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-05-01, and EPSS assigns it a 99.9% probability of exploitation within 30 days (100th percentile).

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2023-21839 (January 2023 CPU) to WebLogic Server per Oracle's instructions, prioritizing internet-facing systems given the KEV listing. Restrict network access to the T3 (default TCP 7001) and IIOP listeners to trusted hosts only, and check exposed servers for signs of compromise. Ransomware linkage is unknown, so treat all affected instances as patch-priority rather than only ransomware-targeted ones.