{"id":"CVE-2021-2135","published":"2021-04-22T21:53:44Z","modified":"2024-09-26T18:16:02Z","title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container)","vendor":"Oracle Corporation","product":"WebLogic Server","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"WebLogic Server","versions":["12.2.1.3.0","12.2.1.4.0","14.1.1.0.0"]}],"description":{"text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"A flaw in the Coherence Container component of Oracle WebLogic Server, part of Oracle Fusion Middleware, affects that product. An unauthenticated attacker with network access over the T3 or IIOP protocols can easily exploit it without any user interaction or special configuration, and successful exploitation can lead to full takeover of the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.08438,"percentile":0.94994,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-10-07","exploitedFirstSeen":"2021-10-07","ransomware":false,"evidence":[{"url":"https://vblocalhost.com/uploads/VB2021-50.pdf","date":"2021-10-07"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Malware Gh0stTimes Used by BlackTech","url":"https://otx.alienvault.com/pulse/615c2a13c152c6c325889282","created":"2021-10-05"},{"name":"Gh0stTimes used by attack group BlackTech","url":"https://otx.alienvault.com/pulse/6152f9ebebe2df07f211e3a7","created":"2021-09-28"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2021.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-16594","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-16594","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-2135","name":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-2135.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-2135.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-04-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-2135","provenance":"source"},{"date":"2021-10-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://vblocalhost.com/uploads/VB2021-50.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1850 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.0,"detail":"percentile 0.9499"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}