CVE-2015-4852

KEVOracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Description

Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedNov 18, 2015

Last modifiedJun 17, 2026

Added to KEVNov 3, 2021

Remediation dueMay 3, 2022

References

foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/Exploit
packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlExploitThird Party Advisory
openwall.com/lists/oss-security/2015/11/17/19Mailing ListThird Party Advisory
oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlPatch
oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatchVendor Advisory
oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlPatchVendor Advisory
oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatchVendor Advisory
oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.htmlVendor Advisory
oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatchVendor Advisory
securityfocus.com/bid/77539Broken Link
securitytracker.com/id/1038292Broken Link
blogs.oracle.com/security/entry/security_alert_cve_2015_4852Broken Link

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1638 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 95.0% · top 1% of all CVEs
Weakness: CWE-502
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.