CVE-2015-4852 — Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache

01What is this vulnerability?

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

02Affected products

Vendor	Product	Versions
n	a / n/a	n/a

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2021-11-03. Ransomware use: Unknown.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2015-11-18T15:00:00.000Z
• Last modified: 2025-10-21T23:55:57.062Z
• Added to CISA KEV: 2021-11-03
• BOD 22-01 due: 2022-05-03

09References

• www.oracle.com — http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
• www.oracle.com — http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
• www.oracle.com — http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
• www.oracle.com — http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• github.com — https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py
• www.oracle.com — http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• blogs.oracle.com — https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852
• www.securitytracker.com — http://www.securitytracker.com/id/1038292
• www.securityfocus.com — http://www.securityfocus.com/bid/77539
• www.oracle.com — http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.ht…
• www.openwall.com — http://www.openwall.com/lists/oss-security/2015/11/17/19
• www.exploit-db.com — https://www.exploit-db.com/exploits/42806/
• foxglovesecurity.com — http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-…
• packetstormsecurity.com — http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserializati…
• www.exploit-db.com — https://www.exploit-db.com/exploits/46628/