CVE-2019-2725 KEVRansomwarePublic exploit Critical · 9.8 EPSS >99.9%

Oracle WebLogic Server, Injection

Oracle · WebLogic Server

Summary

The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services subcomponent) contains an injection flaw in versions 10.3.6.0.0 and 12.1.3.0.0. An unauthenticated attacker with network access over HTTP needs no user interaction or special configuration to exploit it, and successful exploitation can lead to takeover of the server.

Official description · NVD

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Breakdown

88.8 / 100

Exploited: Yes, in CISA KEV
Reports: 4
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What can follow
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules
- Run commands on the systemT1059 · Command and Scripting InterpreterSource dataMedium confidence95 general detection rules

First seen exploited 4 days after disclosure. Public exploit code (PoC-in-GitHub) was available 7 months before disclosure.

Public exploit codePoC-in-GitHub13 Sep 20187 mo before
Disclosed26 Apr 2019day 0
First seen exploitedVulnCheck KEV evidence30 Apr 2019+4 days
Named in a threat reportIntel 47116 Nov 2020+19 mo
Added to CISA KEVknown ransomware use; EU database agrees10 Jan 2022+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 4 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the CVE · uncategorised

Exploit Public-Facing Application (ATT&CK T1190) : Attackers exploit vulnerabilities in enterprise applications to distribute it, such as the deserialization vulnerability CVE-2019-2725 in Oracle WebLogic Server having a CVSS score of 9.8/10.

A brief history and further technical analysis of Sodinokibi Ransomware picussecurity.com Original ↗

One of the most ubiquitous ransomware variants on the market, deployments of REvil first were observed on April 17, 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.

Ransomware-as-a-service: The pandemic within a pandemic Intel 471, 16 Nov 2020 Original ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium

MITRE CTID mapping of the CVE · uncategorised

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-2725 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 4 threat reports

4 reportsIntel 471intel471.compicussecurity.com+1Nov 2020 · 3 undated

Reports are matched by finding the exact id CVE-2019-2725 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Intel 47116 Nov 2020

Ransomware-as-a-service: The pandemic within a pandemic

One of the most ubiquitous ransomware variants on the market, deployments of REvil first were observed on April 17, 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.

Original (opens in a new tab) ↗

intel471.comUndated

REvil Ransomware-as-a-Service: An analysis of a ransomware affiliate operation

Deployments of REvil first were observed in April 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.

Original (opens in a new tab) ↗

picussecurity.comUndated

A brief history and further technical analysis of Sodinokibi Ransomware

Exploit Public-Facing Application (ATT&CK T1190) : Attackers exploit vulnerabilities in enterprise applications to distribute it, such as the deserialization vulnerability CVE-2019-2725 in Oracle WebLogic Server having a CVSS score of 9.8/10.

Original (opens in a new tab) ↗

NCSC UKUndated

Advisory further TTPs associated with SVR cyber actors

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

9 links, grouped by NVD tag (8 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 10 Jan 2022. Federal due date 10 Jul 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 10 Jan 2022. EUVD-2019-12364

Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code ExecutionEDB-46780 · webapps · windows · 2019-04-30
Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)EDB-46814 · remote · multiple · 2019-05-08 · verified
Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)EDB-46814 · remote · multiple · 2019-05-08 · verified

, 30 Oct 2026

>99.9%Top 0.02%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.98%).

3.1

9.8Critical · 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 2741 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9998 20.0/20

Threat reports4 reports 9.0/10

Public exploit code1 NVD reference tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 18 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 9.8 6.9/7

End-of-life productsupported or unknown 0.0

Total88.8

Record

Published: 26 Apr 2019
Modified: 1 Oct 2026
: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Ransomware-as-a-service: The pandemic within a pandemic

REvil Ransomware-as-a-Service: An analysis of a ransomware affiliate operation

A brief history and further technical analysis of Sodinokibi Ransomware

Advisory further TTPs associated with SVR cyber actors

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 4

US Government Resource 1

Third Party Advisory 3

Broken Link 1

What can follow

techniques