Oracle WebLogic Server Console Remote Code Execution and Authentication Bypass Vulnerability (CVE-2020-14750) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTOracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
Unauthenticated remote attackers with network access via HTTP can bypass authentication on the administration console and achieve full remote code execution (RCE)
Immediately apply the official Oracle security patches and restrict network access to the WebLogic Administration Console (/console)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest Patch Set Update (PSU) provided by Oracle. Use the OPatch utility to apply the patch as shown below:
# Load WebLogic environment and stop the server
cd /u01/app/oracle/middleware/user_projects/domains/base_domain/bin
./stopWebLogic.sh
# Navigate to OPatch and apply the downloaded patch
export PATH=$PATH:$ORACLE_HOME/OPatch
cd /u01/app/oracle/patches/32124456
opatch apply
# Verify patch application
opatch lsinventory2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict access to the administration console (/console) using a reverse proxy like Nginx:
# Nginx configuration block (/etc/nginx/nginx.conf)
server {
listen 80;
server_name weblogic.internal;
# Block access to the console and bypass patterns
location ~* ^/(console|console.portal|css/.*console) {
allow 10.0.0.0/8; # Allow trusted internal admin IPs only
deny all;
proxy_pass http://127.0.0.1:7001;
}
location / {
proxy_pass http://127.0.0.1:7001;
}
}3. Log Audit & IoC Verification Commands
Run the following shell script to scan WebLogic access logs for potential exploitation attempts:
#!/bin/bash
LOG_DIR='/u01/app/oracle/middleware/user_projects/domains/base_domain/servers/AdminServer/logs'
echo '[+] Scanning WebLogic Access Logs for CVE-2020-14750 IoCs...'
# Search for double-encoded dot-dot-slash (%252e%252e) and console.portal access
grep -Ei '(%252e%252e|console\.portal|/css/)' $LOG_DIR/access.log* | grep -E ' 200 | 302 '
if [ $? -eq 0 ]; then
echo '[WARNING] Potential exploitation attempts or successful bypass detected in logs!'
else
echo '[OK] No obvious CVE-2020-14750 exploitation patterns found.'
fiBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-14750) is a critical authentication bypass and remote code execution (RCE) vulnerability in the Console component of Oracle WebLogic Server. It stems from an incomplete patch for the previously disclosed CVE-2020-14882. Due to improper sanitization and parsing of HTTP request URLs, the WebLogic server fails to correctly filter crafted paths containing double-encoded characters or relative path traversal sequences, allowing attackers to bypass security filters and access administrative resources directly.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTP GET or POST request to the WebLogic administration port (typically 7001). By utilizing double-encoded directory traversal sequences such as '/console/css/%252e%252e%252fconsole.portal', the attacker tricks the security filter into treating the request as a non-restricted static resource access. However, the internal servlet container decodes the path and routes the request to the administrative console portal. Once authenticated access is bypassed, the attacker can invoke internal classes (such as MBeans or ShellSessionShare) to execute arbitrary OS commands with the privileges of the WebLogic process.
3. Infrastructure & Business Impact
With a CVSS 3.1 base score of 9.8 (Critical) and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat as it is actively exploited in the wild. Successful exploitation allows complete takeover of the Oracle WebLogic Server, leading to unauthorized data access, system modification, deployment of ransomware, and potential lateral movement within the internal enterprise network.
Official Vendor Advisories & References
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Frequently Asked SecOps Questions (CVE-2020-14750)
FAQQ1. How critical is CVE-2020-14750 and is it actively exploited in the wild?
CVE-2020-14750 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-14750?
Primary impacted vendors include oracle across weblogic_server. Scope summary: Oracle WebLogic Server: 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Q3. What temporary mitigations or workarounds exist for CVE-2020-14750 before patching?
[Mitigation] Immediately apply the official Oracle security patches and restrict network access to the WebLogic Administration Console (/console) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-14750
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (oracle)
View Category →Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)
[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.