CVE-2020-14882

Confirmed PUBLISHED

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are...

Oracle Corporation · WebLogic Server

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

117

Unique Attacker IPs

CISA KEV

In CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

9.8 Critical EPSS 100.0%

At a Glance

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

metasploit cisa nuclei_scanner

CVE Published: Oct 21, 2020
Exploitation Reported: Nov 03, 2021
CVSS: 9.8 Critical
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Oracle Corporation	WebLogic Server	10.3.6.0.0	Affected
Oracle Corporation	WebLogic Server	12.1.3.0.0	Affected
Oracle Corporation	WebLogic Server	12.2.1.3.0	Affected
Oracle Corporation	WebLogic Server	12.2.1.4.0	Affected
Oracle Corporation	WebLogic Server	14.1.1.0.0	Affected

CVE References

oracle.com/security-alerts/cpuoct2020.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuoct2020.html
packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Remote-C... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/159769/Oracle-WebLogic-Server-Re...
packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administ... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Ad...
packetstormsecurity.com/files/161128/Oracle-WebLogic-Server-12.2.1.0... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/161128/Oracle-WebLogic-Server-12...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
KEVIntel	2026-06-12 08:09 UTC
The Shadowserver	2026-07-08 00:00 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 4
Distinct User-Agents: 22

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14882.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/weblogic_admin_handle_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Active exploitation observed

Recorded 2026-06-15 08:20:50 UTC · KEVIntel sensor

Proof of concept available

Recorded 2020-10-28 11:43:37 UTC · GitHub

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/weblogic_admin_handle_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-14882.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

AleksaZatezalo/CVE-2020-14882

github · Created 2024-12-26 04:45:46 UTC · 0 stars

xMr110/CVE-2020-14882

github · Created 2024-02-04 09:36:09 UTC · 0 stars

LucasPDiniz/CVE-2020-14882

github · Created 2023-11-09 04:31:26 UTC · 0 stars

Takeover of Oracle WebLogic Server

Danny-LLi/CVE-2020-14882

github · Created 2023-07-17 07:59:01 UTC · 2 stars

This script allows for remote code execution (RCE) on Oracle WebLogic Server

Root-Shells/CVE-2020-14882

github · Created 2023-04-28 12:38:52 UTC · 0 stars

CVE-2020-14882 rewritten in PowerShell

nik0nz7/CVE-2020-14882

github · Created 2023-04-11 08:38:47 UTC · 0 stars

N0Coriander/CVE-2020-14882-14883

github · Created 2021-07-03 02:02:42 UTC · 2 stars

结合14882的未授权访问漏洞，通过14883可远程执行任意代码

qianniaoge/CVE-2020-14882_Exploit_Gui

github · Created 2021-05-25 08:59:45 UTC · 0 stars

exploitblizzard/CVE-2020-14882-WebLogic

github · Created 2021-05-10 21:32:36 UTC · 3 stars

Check YouTube - https://youtu.be/O0ZnLXRY5Wo

kk98kk0/CVE-2020-14882

github · Created 2021-03-31 07:49:06 UTC · 3 stars

CVE-2020-14882部署冰蝎内存马

milo2012/CVE-2020-14882

github · Created 2021-02-25 12:57:08 UTC · 8 stars

CVE-2020-14882

pwn3z/CVE-2020-14882-WebLogic

github · Created 2021-01-29 13:12:40 UTC · 0 stars

BabyTeam1024/CVE-2020-14882

github · Created 2020-11-17 14:23:23 UTC · 0 stars

xfiftyone/CVE-2020-14882

github · Created 2020-11-12 11:27:39 UTC · 5 stars

corelight/CVE-2020-14882-weblogicRCE

github · Created 2020-11-12 06:59:54 UTC · 7 stars

Detection of RCE in Oracle's WebLogic Server CVE-2020-14882 / CVE-2020-14750

Ormicron/CVE-2020-14882-GUI-Test

github · Created 2020-11-11 06:52:32 UTC · 2 stars

基于qt的图形化CVE-2020-14882漏洞回显测试工具.

murataydemir/CVE-2020-14882

github · Created 2020-11-09 13:02:43 UTC · 2 stars

[CVE-2020-14882] Oracle WebLogic Server Authentication Bypass

QmF0c3UK/CVE-2020-14882

github · Created 2020-11-09 08:03:44 UTC · 8 stars

NS-Sp4ce/CVE-2020-14882

github · Created 2020-11-04 03:09:13 UTC · 21 stars

CVE-2020-14882/14883/14750

GGyao/CVE-2020-14882_ALL

github · Created 2020-11-03 10:49:35 UTC · 145 stars

CVE-2020-14882_ALL综合利用工具，支持命令回显检测、批量命令回显、外置xml无回显命令执行等功能。

GGyao/CVE-2020-14882_POC

github · Created 2020-10-31 01:43:54 UTC · 12 stars

CVE-2020-14882批量验证工具。

alexfrancow/CVE-2020-14882

github · Created 2020-10-30 11:07:11 UTC · 0 stars

XTeam-Wing/CVE-2020-14882

github · Created 2020-10-29 06:30:30 UTC · 17 stars

CVE-2020-14882 Weblogic-Exp

s1kr10s/CVE-2020-14882

github · Created 2020-10-28 21:28:12 UTC · 29 stars

CVE-2020–14882 by Jang

jas502n/CVE-2020-14882

github · Created 2020-10-28 11:43:37 UTC · 283 stars

CVE-2020–14882、CVE-2020–14883

Oracle Weblogic Server - Remote Command Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

8 Jul 2026 00:00 UTC 11 days ago

8 Jul 2026 00:00 UTC · 11 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
22 Jun 2026 14:21 UTC 27 days ago

22 Jun 2026 14:21 UTC · 27 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
15 Jun 2026 08:20 UTC about 1 month ago

15 Jun 2026 08:20 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
12 Jun 2026 00:32 UTC about 1 month ago

12 Jun 2026 00:32 UTC · about 1 month ago

Indicators of compromise added (16)

Indicators of compromise recorded
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
3 Nov 2021 00:00 UTC over 4 years ago

3 Nov 2021 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
28 Oct 2020 11:43 UTC over 5 years ago

28 Oct 2020 11:43 UTC · over 5 years ago

Public PoC available

Public proof-of-concept code published
21 Oct 2020 14:04 UTC over 5 years ago

21 Oct 2020 14:04 UTC · over 5 years ago

CVE published

Vulnerability disclosed publicly
19 Jun 2020 00:00 UTC about 6 years ago

19 Jun 2020 00:00 UTC · about 6 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-14882

{
  "cve_id": "CVE-2020-14882",
  "title": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middlewa...",
  "affected_vendor": "Oracle Corporation",
  "affected_product": "WebLogic Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": 0.99997,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-14882

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 41 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API