CVE-2015-4852The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protoc…
Updated under an hour ago ()
Does this affect you?
It affects oracle virtual_desktop_infrastructure and 2 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-502
- Known exploited
- Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 94.99% (percentile 100)
- Assigned by
- oracle
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
oracle virtual_desktop_infrastructure oracle:virtual_desktop_infrastructure | through 3.5.2 | NVD |
oracle storagetek_tape_analytics_sw_tool oracle:storagetek_tape_analytics_sw_tool | 2.3 | NVD |
oracle weblogic_server oracle:weblogic_server | 10.3.6.0.0; 12.1.2.0.0; 12.1.3.0.0; 12.2.1.0.0 | NVD |
References
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlx-refsource-confirm, patch, vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlx-refsource-confirm, patch
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlx-refsource-confirm, patch, vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlx-refsource-confirm, patch, vendor-advisory
- https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.pyx-refsource-misc, product
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlx-refsource-confirm, patch, vendor-advisory
- https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852x-refsource-confirm, broken-link
- http://www.securitytracker.com/id/1038292vdb-entry, x-refsource-sectrack, broken-link
- http://www.securityfocus.com/bid/77539vdb-entry, x-refsource-bid, broken-link
- http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.htmlx-refsource-confirm, vendor-advisory
- http://www.openwall.com/lists/oss-security/2015/11/17/19mailing-list, x-refsource-mlist, third-party-advisory
- https://www.exploit-db.com/exploits/42806/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/x-refsource-misc, exploit
- http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlx-refsource-misc, exploit, third-party-advisory, vdb-entry
- https://www.exploit-db.com/exploits/46628/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.