{"id":"CVE-2023-21839","published":"2023-01-18T00:15:13Z","modified":"2026-06-17T05:34:09Z","title":"Oracle WebLogic Server Unspecified Vulnerability","vendor":"Oracle","product":"WebLogic Server","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provenance":"source","from":"NVD"},"summary":{"text":"An unspecified flaw in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, affects versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can exploit it with low complexity and no user interaction to gain unauthorized access to critical data, or potentially all data accessible to WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:00Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.999,"percentile":0.99966,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-05-01","dueDate":"2023-05-22","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.oracle.com/security-alerts/cpujan2023.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-21839","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-05-01","exploitedFirstSeen":"2023-05-01","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-05-01"},{"url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":"2023-06-02"},{"url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/report-crowdstrike-2023-threat-hunting-report.pdf","date":"2023-08-08"},{"url":"https://www.rapid7.com/globalassets/_pdfs/research/rapid7_2024_attack_intelligence_report.pdf","date":"2024-05-21"},{"url":"https://www.broadcom.com/support/security-center/protection-bulletin/unveiling-cryptocurrency-mining-tactic-of-the-8220-gang","date":"2024-05-30"},{"url":"https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html","date":"2024-05-30"},{"url":"https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html","date":"2024-06-28"},{"url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report--cyber-security-report-2025","date":"2025-02-09"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"},{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/cpujan2023.html","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/cpujan2023.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network exploit against public-facing WebLogic service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server","start":181,"end":315}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthorized access to critical data implies data collection","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in  unauthorized access to critical data","start":318,"end":410}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-00137fe8f183bbad0ec9","title":"Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure","publisher":"blog.eclecticiq.com","url":"https://blog.eclecticiq.com/chinese-threat-actor-used-modified-cobalt-strike-variant-to-attack-taiwanese-critical-infrastructure","date":null,"mentions":[{"quote":"observed that the threat actor primarily focuses on four different known remote code execution (RCE) vulnerabilities during their operations:•    CVE-2023-21839      Oracle WebLogic Server RCE [13]•    CVE-2021-3129      Laravel debug mode RCE [14]•    CVE-2020-2551      Oracle WebLogic RCE [15]•","start":4792,"end":5089},{"quote":"[13]      “NVD - CVE-2023-21839.”","start":23001,"end":23034},{"quote":"https://nvd.nist.gov/vuln/detail/CVE-2023-21839 (accessed Apr.","start":23035,"end":23097}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-26005","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26005","exploited":true,"exploitedSince":"2023-05-01","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":1,"earliest":"2023-02-21","earliestUrl":"https://github.com/DXask88MA/Weblogic-CVE-2023-21839","repos":[{"name":"DXask88MA/Weblogic-CVE-2023-21839","url":"https://github.com/DXask88MA/Weblogic-CVE-2023-21839","stars":242,"created":"2023-02-21"},{"name":"ASkyeye/CVE-2023-21839","url":"https://github.com/ASkyeye/CVE-2023-21839","stars":118,"created":"2023-02-24"},{"name":"dinosn/CVE-2024-20931","url":"https://github.com/dinosn/CVE-2024-20931","stars":61,"created":"2024-02-06"},{"name":"Firebasky/CVE-2023-21839","url":"https://github.com/Firebasky/CVE-2023-21839","stars":26,"created":"2023-03-11"},{"name":"houqe/POC_CVE-2023-21839","url":"https://github.com/houqe/POC_CVE-2023-21839","stars":19,"created":"2023-04-15"}]},"metasploit":[{"name":"Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization","module":"exploit/multi/iiop/cve_2023_21839_weblogic_rce","type":"exploit","disclosureDate":"2023-01-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb"}],"nuclei":[{"id":"CVE-2023-21839","name":"Oracle WebLogic Server - Unauthorized Access","severity":"high","path":"javascript/cves/2023/CVE-2023-21839.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2023/CVE-2023-21839.yaml"}],"first":{"date":"2023-01-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2023-01-17","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-02-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb","provenance":"source"},{"date":"2023-01-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21839","provenance":"source"},{"date":"2023-05-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-05-01","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-05-01","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-26005","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":103},"priority":{"score":72.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1277 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-oracle-weblogic-server-cwe-502"}}