Skip to content
Fencer Intel
critical 9.8

CVE-2015-4852 kev in the critical feed json

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrar…

published 2015-11-18 10 y ago modified 2026-06-17 4 mo ago also EUVD-2015-4869

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
95.0%
EPSS 95.0% chance of exploitation in 30 days, percentile 99.8%
public exploits
4
Metasploit, Exploit-DB

Summary

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • libcommons-collections3-java Ubuntu Pro 14.04 LTS 3.2.1-6ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2015-4852

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • apache-commons-beanutils SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.11.0-7.3.1

suse advisories SUSE-SU-2025:02056-1

  • apache-commons-validator openSUSE Tumbleweed 1.10.1-1.1
  • apache-commons-beanutils openSUSE Tumbleweed 1.9.4-3.7

opensuse advisories openSUSE-SU-2026:11105-1openSUSE-SU-2024:10617-1

Timeline

  1. First public exploit (Metasploit exploit/multi/misc/weblogic_deserialize_rawobject)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2022-05-03 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Oracle, WebLogic Server
CISA name
Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

94.99% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/misc/weblogic_deserialize_rawobject Oracle Weblogic Server Deserialization RCE - Raw Object metasploit exploit, excellent rank, 2015-01-28
  • EDB-46628 Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit) remote, 2019-03-28
  • EDB-44552 Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution remote, 2016-07-20
  • EDB-42806 Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution remote, 2017-09-27
  • foxglovesecurity.com http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.