CVE-2019-2725: Oracle WebLogic unauthenticated deserialization RCE, widely exploited
The short version: CVE-2019-2725 is an unauthenticated deserialization flaw in the Web Services component of Oracle WebLogic Server. A crafted request yields remote code execution and full server takeover — no credentials required. It was exploited at scale by cryptomining and ransomware crews, Oracle shipped an out-of-band Security Alert, and it's in CISA's KEV catalog. Steady hands — but move: patch and lock down the vulnerable endpoints.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.96% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-07-10 |
| Known exploited? | Yes — mass exploitation, including cryptominers and ransomware (known ransomware use) |
| Vulnerability type | CWE-502 unsafe deserialization (NVD: CWE-74 injection) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle WebLogic Server 10.3.6.0.0 and 12.1.3.0.0 (Web Services subcomponent) |
| Fixed in | Per Oracle's Security Alert for CVE-2019-2725 — apply the vendor patch |
What you need to know
WebLogic is a Java application server fronting many enterprise applications, and its wls9_async / wls-wsat Web Services endpoints are reachable over HTTP. CVE-2019-2725 is an unsafe deserialization: a crafted SOAP request carries a serialized object that WebLogic reconstructs without restricting the "gadget chains" it will build, letting an unauthenticated attacker execute code and take over the server.
Why this became one of the most exploited WebLogic flaws of its era:
- It's unauthenticated and low-complexity. One crafted HTTP request, no login.
- It gives full takeover. Deserialization RCE means control of the app server and everything it can reach.
- Attackers industrialized it. It was swept up by cryptomining botnets and ransomware operators, and it remains near the very top of EPSS years later.
- Oracle broke glass. The severity and active exploitation prompted an out-of-band Security Alert rather than waiting for a quarterly update.
How serious we see it
Critical — the 9.8 is not hyperbole.
Unauthenticated, network-reachable code execution on an internet-facing application server, exploited en masse and associated with ransomware, is the definition of top-of-queue. Paper and practice agree; there's no gap to explain.
The bounded, reassuring part: it affects specific WebLogic versions via specific endpoints, Oracle's fix is published, and exposure is quick to determine. The catch is history — a server that sat exposed and unpatched has likely been probed, so treat patching and incident review as two separate tasks.
Recommendations
Straight from Oracle's Security Alert and CISA:
- Patch now. Apply Oracle's fix for CVE-2019-2725 to affected WebLogic 10.3.6.0.0 / 12.1.3.0.0.
- Restrict the vulnerable endpoints. Until patched, control access to the
/_async/*and/wls-wsat/*paths via access policy. - Hunt. Review logs for crafted SOAP requests to those endpoints and for cryptominer or webshell artifacts; assume an exposed, unpatched server may have been compromised.
- If you find indicators, respond fully. Rebuild where warranted and rotate all credentials, keys, and secrets reachable from the server.
- Confirm your exposure first. Verify whether you run an affected WebLogic version with those Web Services endpoints reachable.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing WebLogic interfaces, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited flaw so it rises to the top of your results. Where verification is enabled, it goes a safe step beyond a scanner: it sends a single benign probe to the affected endpoint and checks the response for the tell-tale behavior of the flaw — confirming the exposure holds, without deploying a working payload.
That outside-in, continuous view is the point: an exposed, affected WebLogic is already mapped, so you go straight to patch-and-verify.