Read the docs
TI-2015-04072 Aliases CVE-2015-4852GHSA-7r6v-mxc2-pg49

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and…

Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Why it matters now

Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.94991 99th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:oracle:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*up to 3.5.2VulnerableOracle
cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:*2.3VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*10.3.6.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.1.2.0.0:*:*:*:*:*:*:*12.1.2.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*12.1.3.0.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:*12.2.1.0.0VulnerableOracle
  • cpe:2.3:a:oracle:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* Versions up to 3.5.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:* Versions 10.3.6.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.1.2.0.0:*:*:*:*:*:*:* Versions 12.1.2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:* Versions 12.1.3.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.0.0:*:*:*:*:*:*:* Versions 12.2.1.0.0 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2021-11-03 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2015-4852
  3. 2026-10-03 Alias added: GHSA-7r6v-mxc2-pg49

References

Exploit 4

Patch 5

Advisory 2

Other 2

  • TI-2019-02266 Injection in Oracle Tape Library ACSLS KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-02270 Improper access control in Oracle WebLogic Server CVSS 3.1CRITICAL 9.8
  • TI-2020-08897 Potential XSS vulnerability in jQuery KEVCVSS 3.1MEDIUM 6.9
  • TI-2019-08480 jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles… CVSS 3.1MEDIUM 6.1
  • TI-2020-08586 dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by… CVSS 3.1CRITICAL 9.8
  • TI-2020-04467 RFD Protection Bypass via jsessionid CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences