CVE-2019-2729: Oracle WebLogic unauthenticated deserialization RCE (a 2725 bypass)
The short version: CVE-2019-2729 is an unauthenticated deserialization flaw in the Web Services component of Oracle WebLogic Server. A crafted request leads to remote code execution and full server takeover — no credentials needed. It appeared as a bypass of the fix for CVE-2019-2725 and was exploited in the wild as a zero-day. Oracle shipped an out-of-band Security Alert for it. Steady hands — but move: patch and restrict the vulnerable endpoints.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 88.8% · 99.8th percentile (2026-07-17) |
| In CISA KEV? | No — not listed as of writing |
| Known exploited? | Yes — exploited in the wild as a zero-day; a bypass of the CVE-2019-2725 patch |
| Vulnerability type | CWE-502 unsafe deserialization (NVD: CWE-284 improper access control) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 |
| Fixed in | Per Oracle's Security Alert for CVE-2019-2729 — apply the vendor patch |
What you need to know
WebLogic is a Java application server that fronts a lot of enterprise applications, and its Web Services endpoints (wls9_async / wls-wsat) are reachable over HTTP. CVE-2019-2729 is an unsafe deserialization: a crafted SOAP request carries a serialized object that the server reconstructs without properly restricting what it will build, letting an attacker trigger code execution and take over the server.
Why this one is a top-of-queue flaw:
- It's unauthenticated and network-reachable. One crafted HTTP request; no login.
- It yields full takeover. Deserialization RCE on WebLogic means control of the app server and everything it can reach.
- It was a live zero-day. Researchers found it was a bypass of the patch Oracle shipped for CVE-2019-2725 — attackers were already using it, which is why Oracle issued an out-of-band Security Alert rather than waiting for a quarterly update.
How serious we see it
Critical — the 9.8 is not hyperbole.
Unauthenticated, low-complexity code execution that takes over an internet-facing application server, born as a patch bypass and used in the wild, is the definition of critical. It isn't in CISA's KEV catalog, but it doesn't need a listing to earn the rating — the exploitation history speaks for itself.
The bounded, reassuring part: it affects specific WebLogic versions via specific Web Services endpoints, Oracle's fix is published, and you can quickly determine whether you run an affected, exposed instance. The catch is the same as any patch-bypass zero-day — being patched and being clean are separate questions.
Recommendations
Straight from Oracle's Security Alert and public analysis:
- Patch now. Apply Oracle's fix for CVE-2019-2729 to affected WebLogic 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0.
- Restrict the vulnerable endpoints. Until patched, control access to the
/_async/*and/wls-wsat/*paths via access policy. - Hunt for prior use. Given the zero-day window, review logs for crafted SOAP requests to those endpoints and for signs of code execution; assume an exposed, unpatched server may have been touched.
- If you find indicators, respond fully. Rebuild where warranted and rotate credentials, keys, and secrets reachable from the server.
- Confirm your exposure first. Verify whether you run an affected WebLogic version with those Web Services endpoints reachable.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing WebLogic interfaces, fingerprints the version, and flags exposure tied to this actively exploited flaw so it rises to the top of your results. Where verification is enabled, it goes a safe step beyond a scanner: it sends a single benign probe to the affected endpoint and checks the response for the tell-tale behavior of the flaw — confirming the exposure holds, without deploying a working payload.
That outside-in, continuous view is the point: an exposed, affected WebLogic is already mapped, so you go straight to patch-and-verify.