CVE-2020-14882: Oracle WebLogic Console unauthenticated RCE, trivially exploited
The short version: CVE-2020-14882 is an unauthenticated remote code execution flaw in the Oracle WebLogic Server administration console. A single crafted HTTP request — combining a path traversal with a Java class instantiation — runs code as the WebLogic user and takes over the server. It was exploited within a week of the fix, botnets adopted it fast, and it's in CISA's KEV catalog with an EPSS near the maximum. Steady hands — but move: patch and get the console off the internet.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.99th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — mass exploitation within days of the patch; adopted by multiple botnets |
| Vulnerability type | Path traversal + unsafe class instantiation (NVD: CWE-Other) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication (console auth bypass) |
| Affected | Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 (Console) |
| Fixed in | Oracle Critical Patch Update, October 2020 (see the patch bypass CVE-2020-14750) |
What you need to know
WebLogic's administration console is a web interface for managing the server. CVE-2020-14882 lets an unauthenticated attacker reach protected console functionality by smuggling a path-traversal in the request, then abusing a class-instantiation sink to execute code — no credentials at all.
Why this one was a scanner-and-botnet favorite:
- It's exceptionally easy. A single crafted GET request. Attackers construct one URL and get code execution.
- It's the management plane. Control of the WebLogic console means control of the app server and its deployed applications.
- It was weaponized almost immediately. Public reporting confirmed active exploitation within roughly a week of the October 2020 patch — a day after a proof-of-concept appeared — and at least two botnets folded it in.
- The first patch was bypassable. Oracle followed with an out-of-band fix for CVE-2020-14750; various encoding/case tricks defeated the initial blocklist.
How serious we see it
Critical — the 9.8 is fully earned.
Trivially exploitable, unauthenticated code execution on an internet-facing management console, mass-exploited within days and in CISA's KEV catalog with an EPSS effectively at the ceiling, is unambiguous. Paper and practice agree.
The bounded, reassuring part: it affects specific WebLogic versions, the fixes (and the follow-up bypass fix) are published, and exposure is quick to confirm. The catch is the same as any fast-weaponized flaw — an exposed, unpatched console has almost certainly been probed, so pair patching with a compromise review.
Recommendations
Straight from Oracle's October 2020 CPU and public analysis:
- Patch now. Apply the October 2020 Critical Patch Update, and ensure the follow-up fix for the CVE-2020-14750 bypass is also in place.
- Get the console off the internet. Block access to the admin console (default TCP 7001) from untrusted networks — a strong partial mitigation on its own.
- Hunt. Review logs for requests containing double-encoded path traversals and the
console.portalpath; look for cryptominer or webshell artifacts. - If you find indicators, respond fully. Rebuild where warranted and rotate credentials, keys, and secrets on the server.
- Confirm your exposure first. Verify whether you run an affected WebLogic version with the console reachable from the internet.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing WebLogic interfaces, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited flaw so it rises to the top of your results. Where verification is enabled, it goes a safe step beyond a scanner: it sends a single benign probe to the affected endpoint and checks the response for the tell-tale behavior of the flaw — confirming the exposure holds, without deploying a working payload.
That outside-in, continuous view is the point: an exposed, affected WebLogic console is already mapped, so you go straight to patch-and-verify.