{"id":"CVE-2019-2725","published":"2019-04-26T19:29:00Z","modified":"2026-10-01T21:17:15Z","title":"Oracle WebLogic Server, Injection","vendor":"Oracle","product":"WebLogic Server","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services subcomponent) contains an injection flaw in versions 10.3.6.0.0 and 12.1.3.0.0. An unauthenticated attacker with network access over HTTP needs no user interaction or special configuration to exploit it, and successful exploitation can lead to takeover of the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:10Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99977,"percentile":0.99979,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-01-10","dueDate":"2022-07-10","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-2725","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-04-30","exploitedFirstSeen":"2019-04-30","ransomware":true,"evidence":[{"url":"https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html","date":"2019-04-30"},{"url":"https://threatpost.com/new-sodinokibi-ransomware-exploits-critical-oracle-weblogic-flaw/144233/","date":"2019-04-30"},{"url":"https://digital.nhs.uk/cyber-alerts/2019/cc-3044","date":"2019-05-01"},{"url":"https://www.cyber.nj.gov/threat-center/threat-profiles/ransomware-variants/sodinokibi","date":"2019-05-02"},{"url":"https://threatpost.com/oracle-weblogic-exploit-gandcrab-xmrig/144419/","date":"2019-05-06"},{"url":"https://blog.talosintelligence.com/2019/05/threat-source-may-9-19.html","date":"2019-05-09"},{"url":"https://unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/","date":"2019-06-06"},{"url":"https://www.akamai.com/blog/security/latest-echobot-26-infection-vectors","date":"2019-06-13"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-july-2019","date":"2019-08-28"},{"url":"https://web.archive.org/web/20220227045141/https://risksense.com/wp-content/uploads/2019/09/RiskSense-Spotlight-Report-Ransomware.pdf","date":"2019-09-01"}],"evidenceTotal":988,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"}],"references":[{"url":"http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/108074","tags":["Broken Link"]},{"url":"https://support.f5.com/csp/article/K90059138","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46780/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW","tags":["Patch","Vendor Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/108074","tags":["Broken Link"]},{"url":"https://support.f5.com/csp/article/K90059138","tags":["Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/46780/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW","tags":["Patch","Vendor Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Takeover implies arbitrary command execution on server","mappingType":"uncategorized","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server","start":312,"end":401}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping","dataset-annotation","report-attack-id"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Unauthenticated HTTP exploitation of public-facing server; AnnoCTR expert entity-linking label (train split); ATT&CK ID T1190 written in the same sentence as CVE-2019-2725","mappingType":"uncategorized","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP","start":180,"end":273},{"reportId":"SRC-3b381f2178e921f9e087","quote":"Exploit Public-Facing Application (ATT&CK T1190) : Attackers exploit vulnerabilities in enterprise applications to distribute it, such as the deserialization vulnerability CVE-2019-2725 in Oracle WebLogic Server having a CVSS score of 9.8/10.","start":1904,"end":2146},{"reportId":"SRC-80562c870728f3f73674","quote":"One of the most ubiquitous ransomware variants on the market, deployments of REvil first were observed on April 17, 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.","start":8457,"end":8673}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-80562c870728f3f73674","title":"Ransomware-as-a-service: The pandemic within a pandemic","publisher":"Intel 471","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-11-16_ransomware-as-a-service-2020.txt","date":"2020-11-16","mentions":[{"quote":"One of the most ubiquitous ransomware variants on the market, deployments of REvil first were observed on April 17, 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.","start":8457,"end":8673}]},{"id":"SRC-b18366d8718ee8888eed","title":"REvil Ransomware-as-a-Service: An analysis of a ransomware affiliate operation","publisher":"intel471.com","url":"https://www.intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation","date":null,"mentions":[{"quote":"Deployments of REvil first were observed in April 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.","start":237,"end":387}]},{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2019-2725 Oracle WebLogic Server","start":2651,"end":2689}]},{"id":"SRC-3b381f2178e921f9e087","title":"A brief history and further technical analysis of Sodinokibi Ransomware","publisher":"picussecurity.com","url":"https://www.picussecurity.com/resource/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware","date":null,"mentions":[{"quote":"Exploit Public-Facing Application (ATT&CK T1190) : Attackers exploit vulnerabilities in enterprise applications to distribute it, such as the deserialization vulnerability CVE-2019-2725 in Oracle WebLogic Server having a CVSS score of 9.8/10.","start":1904,"end":2146}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-12364","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-12364","exploited":true,"exploitedSince":"2022-01-10","provenance":"source"},"exploits":[{"id":46780,"url":"https://www.exploit-db.com/exploits/46780","title":"Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution","type":"webapps","platform":"windows","date":"2019-04-30","verified":false,"provenance":"source"},{"id":46814,"url":"https://www.exploit-db.com/exploits/46814","title":"Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2019-05-08","verified":true,"provenance":"source"},{"id":46814,"url":"https://www.exploit-db.com/exploits/46814","title":"Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2019-05-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-04-30"},"pocGithub":{"count":18,"skipped":1,"earliest":"2018-09-13","earliestUrl":"https://github.com/shack2/javaserializetools","repos":[{"name":"shack2/javaserializetools","url":"https://github.com/shack2/javaserializetools","stars":516,"created":"2018-09-13"},{"name":"lufeirider/CVE-2019-2725","url":"https://github.com/lufeirider/CVE-2019-2725","stars":432,"created":"2019-05-29"},{"name":"SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961","url":"https://github.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961","stars":105,"created":"2019-04-25"},{"name":"black-mirror/Weblogic","url":"https://github.com/black-mirror/Weblogic","stars":70,"created":"2019-06-24"},{"name":"pimps/CVE-2019-2725","url":"https://github.com/pimps/CVE-2019-2725","stars":52,"created":"2019-08-23"}]},"metasploit":[{"name":"Oracle Weblogic Server Deserialization RCE - AsyncResponseService","module":"exploit/multi/misc/weblogic_deserialize_asyncresponseservice","type":"exploit","disclosureDate":"2019-04-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb"}],"nuclei":[{"id":"CVE-2019-2725","name":"Oracle WebLogic Server - Remote Command Execution","severity":"critical","path":"http/cves/2019/CVE-2019-2725.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-2725.yaml"}],"first":{"date":"2018-09-13","source":"PoC-in-GitHub","url":"https://github.com/shack2/javaserializetools"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46780/","http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html"],"flow":[{"stage":"related","techniques":["T1190","T1059"],"provenance":"source"}],"timeline":[{"date":"2018-09-13","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2019-04-23, Exploit-DB 2019-04-30","url":"https://github.com/shack2/javaserializetools","provenance":"source"},{"date":"2019-04-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-2725","provenance":"source"},{"date":"2019-04-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html","provenance":"source"},{"date":"2020-11-16","kind":"report","label":"Named in Intel 471: Ransomware-as-a-service: The pandemic within a pandemic","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-11-16_ransomware-as-a-service-2020.txt","provenance":"machine"},{"date":"2022-01-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-12364","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":990},"priority":{"score":88.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2741 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 18 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}