{"id":"CVE-2020-2551","published":"2020-01-15T17:15:17Z","modified":"2026-06-17T03:12:20Z","title":"Oracle Fusion Middleware Unspecified Vulnerability","vendor":"Oracle","product":"Fusion Middleware","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"An unspecified flaw in the WLS Core Components of Oracle WebLogic Server, part of Oracle Fusion Middleware, affects supported versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. An unauthenticated attacker with network access via IIOP can easily exploit it, with no user interaction needed, to take over the WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:25Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.92817,"percentile":0.99829,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-11-16","dueDate":"2023-12-07","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/cpujan2020.html; https://nvd.nist.gov/vuln/detail/CVE-2020-2551","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-06-02","exploitedFirstSeen":"2023-06-02","ransomware":false,"evidence":[{"url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":"2023-06-02"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/11/09055246/Modern-Asian-APT-groups-TTPs_report_eng.pdf","date":"2023-11-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-11-16"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/27161250/Kaspersky_MDR_Report_Eng_2023.pdf","date":"2024-04-30"},{"url":"https://www.aquasec.com/blog/sink-or-swim-tackling-2024s-record-breaking-vulnerability-wave/","date":"2024-09-19"},{"url":"https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot","date":"2026-03-25"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2551","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated network exploit against exposed server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server","start":246,"end":336}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: exploitation over IIOP remote service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP","start":206,"end":299}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-00137fe8f183bbad0ec9","title":"Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure","publisher":"blog.eclecticiq.com","url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":null,"mentions":[{"quote":"threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:•    CVE-2023-21839      Oracle WebLogic Server RCE [13]•    CVE-2021-3129      Laravel debug mode RCE [14]•    CVE-2020-2551      Oracle WebLogic RCE [15]•    CVE-2021-44228     Apache Log4j","start":4810,"end":5124},{"quote":"[15]      “NVD - CVE-2020-2551.”","start":23217,"end":23249},{"quote":"https://nvd.nist.gov/vuln/detail/CVE-2020-2551 (accessed Apr.","start":23250,"end":23311}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-22344","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22344","exploited":true,"exploitedSince":"2023-11-16","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":0,"earliest":"2020-01-15","earliestUrl":"https://github.com/daybreak-kits/weblogicScanner","repos":[{"name":"daybreak-kits/weblogicScanner","url":"https://github.com/daybreak-kits/weblogicScanner","stars":2081,"created":"2020-01-15"},{"name":"Y4er/CVE-2020-2551","url":"https://github.com/Y4er/CVE-2020-2551","stars":336,"created":"2020-02-28"},{"name":"hktalent/CVE-2020-2551","url":"https://github.com/hktalent/CVE-2020-2551","stars":210,"created":"2020-01-19"},{"name":"zzwlpx/weblogicPoc","url":"https://github.com/zzwlpx/weblogicPoc","stars":89,"created":"2020-05-16"},{"name":"jas502n/CVE-2020-2551","url":"https://github.com/jas502n/CVE-2020-2551","stars":79,"created":"2020-01-18"}]},"nuclei":[{"id":"CVE-2020-2551","name":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-2551.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-2551.yaml"}],"first":{"date":"2020-01-15","source":"PoC-in-GitHub","url":"https://github.com/daybreak-kits/weblogicScanner"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1210"],"provenance":"ai"}],"timeline":[{"date":"2020-01-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2551","provenance":"source"},{"date":"2020-01-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/daybreak-kits/weblogicScanner","provenance":"source"},{"date":"2023-06-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","provenance":"source"},{"date":"2023-11-16","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-11-16","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22344","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1401},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1246 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"8 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}