Security Advisory 2020-053

Release Date:

Critical Vulnerability in Oracle WebLogic Server



  • 30/10/2020 --- v1.0 -- Initial publication


In October, within the monthly Critical Patch Update Advisory addressing hundreds of vulnerabilities [1], Oracle released an update about a critical vulnerability affecting WebLogic Server. This vulnerability may allow unauthenticated attackers with network access via HTTP to achieve total compromise and takeover of vulnerable Oracle WebLogic Servers [2]. This bug has been assigned CVE-2020-14882 and has a CVSS score of 9.8 and is now being reported as being exploited in the wild [3].

Technical Details

The bug involves different weaknesses in the way the server handles user-supplied requests. An attacker could send a simple HTTP GET request to exploit the vulnerability, execute code and get full control on the server [4].

To address this vulnerability, a patch has been released by Oracle in October 2020. This vulnerability is now reported to be under active exploitation [5].

Affected Products

The vulnerability exists in Oracle WebLogic Server, versions [1]:



It is recommended to apply the necessary patches from the October Oracle Critical Patch Update [1] as soon as possible and to look for any indicator of compromised on your network, beginning with firewall logs.

Detection of Exploitation

The following strings in GET requests could be an indication of successful exploitation [5]:

  • /console/images/%252E%252E%252Fconsole.portal
  • /console/css/%252E%252E%252Fconsole.portal







We got cookies

We only use cookies that are necessary for the technical functioning of our website. Find out more on here.