{"id":"CVE-2018-2628","published":"2018-04-19T02:29:00Z","modified":"2026-06-17T01:55:57Z","title":"Oracle WebLogic Server Unspecified Vulnerability","vendor":"Oracle","product":"WebLogic Server","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"The Oracle WebLogic Server component of Oracle Fusion Middleware (WLS Core Components subcomponent) contains an unspecified flaw affecting versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. An unauthenticated attacker with network access via the T3 protocol can easily exploit it to take over the affected WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99958,"percentile":0.99975,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-09-08","dueDate":"2022-09-29","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.oracle.com/security-alerts/cpuapr2018.html; https://nvd.nist.gov/vuln/detail/CVE-2018-2628","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-09-08","exploitedFirstSeen":"2022-09-08","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-08"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://www.zscaler.com/resources/industry-reports/non-web-attack-surface-report.pdf","date":"2025-10-20"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/103776","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040696","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/brianwrf/CVE-2018-2628","tags":["Broken Link"]},{"url":"https://www.exploit-db.com/exploits/44553/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45193/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46513/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/103776","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1040696","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/brianwrf/CVE-2018-2628","tags":["Broken Link"]},{"url":"https://www.exploit-db.com/exploits/44553/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/45193/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46513/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2628","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: unauthenticated network exploitation of exposed service","mappingType":"uncategorized","evidence":[{"from":"description","quote":"unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server","start":243,"end":331}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: takeover implies arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server","start":333,"end":422}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-14483","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-14483","exploited":true,"exploitedSince":"2022-09-08","provenance":"source"},"exploits":[{"id":44553,"url":"https://www.exploit-db.com/exploits/44553","title":"Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution","type":"remote","platform":"multiple","date":"2018-04-22","verified":true,"provenance":"source"},{"id":45193,"url":"https://www.exploit-db.com/exploits/45193","title":"Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2018-08-13","verified":true,"provenance":"source"},{"id":45193,"url":"https://www.exploit-db.com/exploits/45193","title":"Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"windows","date":"2018-08-13","verified":true,"provenance":"source"},{"id":46513,"url":"https://www.exploit-db.com/exploits/46513","title":"Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass)","type":"remote","platform":"multiple","date":"2018-10-25","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2018-04-22"},"pocGithub":{"count":20,"skipped":1,"earliest":"2018-04-18","earliestUrl":"https://github.com/forlin/CVE-2018-2628","repos":[{"name":"daybreak-kits/weblogicScanner","url":"https://github.com/daybreak-kits/weblogicScanner","stars":2080,"created":"2020-01-15"},{"name":"tdy218/ysoserial-cve-2018-2628","url":"https://github.com/tdy218/ysoserial-cve-2018-2628","stars":114,"created":"2018-05-03"},{"name":"jas502n/CVE-2018-2628","url":"https://github.com/jas502n/CVE-2018-2628","stars":107,"created":"2018-06-05"},{"name":"shengqi158/CVE-2018-2628","url":"https://github.com/shengqi158/CVE-2018-2628","stars":78,"created":"2018-04-18"},{"name":"forlin/CVE-2018-2628","url":"https://github.com/forlin/CVE-2018-2628","stars":20,"created":"2018-04-18"}]},"metasploit":[{"name":"Oracle Weblogic Server Deserialization RCE","module":"exploit/multi/misc/weblogic_deserialize","type":"exploit","disclosureDate":"2018-04-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize.rb"}],"nuclei":[{"id":"CVE-2018-2628","name":"Oracle WebLogic Server Deserialization - Remote Code Execution","severity":"critical","path":"network/cves/2018/CVE-2018-2628.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2018/CVE-2018-2628.yaml"}],"first":{"date":"2018-04-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/44553/","https://www.exploit-db.com/exploits/45193/","https://www.exploit-db.com/exploits/46513/"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2018-04-17","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2018-04-18, Exploit-DB 2018-04-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize.rb","provenance":"source"},{"date":"2018-04-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2628","provenance":"source"},{"date":"2022-09-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-09-08","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-14483","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1603},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1514 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 4 Exploit-DB entries; 20 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-oracle-weblogic-server-cwe-502"}}