{"id":"CVE-2021-2109","published":"2021-01-20T14:50:11Z","modified":"2024-09-26T18:16:10Z","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)","vendor":"Oracle Corporation","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"WebLogic Server","versions":["10.3.6.0.0","12.1.3.0.0","12.2.1.3.0","12.2.1.4.0","14.1.1.0.0"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Console component of Oracle WebLogic Server, part of Oracle Fusion Middleware, affects supported versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An attacker with high privileges and network access over HTTP can easily exploit it, without user interaction, to take over the affected WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:37Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.7112,"percentile":0.99405,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-15","exploitedFirstSeen":"2026-08-15","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-15&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-15"},{"url":"https://previdian.com/CVE-2021-2109","date":"2026-08-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-16&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-17&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-18&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-19&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-20&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-21&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-22&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-25&host_type=src&vulnerability=cve-2021-2109","date":"2026-08-25"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"invoke-mimikatz.hasthe.technology","url":"https://otx.alienvault.com/pulse/676af0f2663cdd2f25ed9e80","created":"2024-12-24"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab46ec79ba3a3f9f859541","created":"2023-07-09"},{"name":"rogers","url":"https://otx.alienvault.com/pulse/64ab412e96e4858e508978c7","created":"2023-07-09"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/161053/Oracle-WebLogic-Server-14.1.1.0-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-16568","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-16568","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":49461,"url":"https://www.exploit-db.com/exploits/49461","title":"Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)","type":"webapps","platform":"java","date":"2021-01-22","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2021-01-22"},"pocGithub":{"count":5,"skipped":1,"earliest":"2021-01-22","earliestUrl":"https://github.com/Al1ex/CVE-2021-2109","repos":[{"name":"Al1ex/CVE-2021-2109","url":"https://github.com/Al1ex/CVE-2021-2109","stars":31,"created":"2021-01-22"},{"name":"rabbitsafe/CVE-2021-2109","url":"https://github.com/rabbitsafe/CVE-2021-2109","stars":9,"created":"2021-01-22"},{"name":"yuaneuro/CVE-2021-2109_poc","url":"https://github.com/yuaneuro/CVE-2021-2109_poc","stars":4,"created":"2021-05-13"},{"name":"Vulnmachines/oracle-weblogic-CVE-2021-2109","url":"https://github.com/Vulnmachines/oracle-weblogic-CVE-2021-2109","stars":3,"created":"2022-08-30"},{"name":"dinosn/CVE-2021-2109","url":"https://github.com/dinosn/CVE-2021-2109","stars":0,"created":"2021-08-09"}]},"first":{"date":"2021-01-22","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/49461"},"provenance":"source"},"detections":{"cveRules":[{"title":"Oracle WebLogic Exploit CVE-2021-2109","id":"687f6504-7f44-4549-91fc-f07bab065821","level":"critical","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-2109/web_cve_2021_2109_weblogic_rce_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-2109/web_cve_2021_2109_weblogic_rce_exploit.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/161053/Oracle-WebLogic-Server-14.1.1.0-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2021-01-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-2109","provenance":"source"},{"date":"2021-01-22","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-49461); later: PoC-in-GitHub 2021-01-22","url":"https://www.exploit-db.com/exploits/49461","provenance":"source"},{"date":"2026-08-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-08-15&host_type=src&vulnerability=cve-2021-2109","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":76.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 75 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}