CVE DatabaseCVE-2020-2555

Updated 2026-06-17한국어 권고문 →

CVE-2020-25559.8/CRITICALCISA KEVCWE-502CWE-502

Oracle Coherence and WebLogic Server T3 Protocol Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2020-2555)

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

coherence, weblogic_server

Published Date

2020-01-15

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

97.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0, including WebLogic Server environments utilizing these components

Impact

Unauthenticated remote attackers can exploit this vulnerability via the T3 protocol to execute arbitrary code and achieve complete takeover of the target system

Mitigation

Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3/T3S protocols (default port 7001) using connection filters

Affected Products & Version Scope

Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the latest Patch Set Update (PSU) provided by Oracle. Use the OPatch utility to apply the security patch to your WebLogic and Coherence home directory as follows:

bash

# 1. Stop all running WebLogic and Coherence server instances
./stopWebLogic.sh

# 2. Set environment variables and apply the patch using OPatch
export PATH=$PATH:$ORACLE_HOME/OPatch
cd /path/to/patched/directory/2555_patch_id
opatch apply

# 3. Verify that the patch has been successfully applied
opatch lsinventory

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, configure WebLogic Connection Filters to block external T3 and T3S traffic while allowing only trusted administrative hosts.

text

# Configure Connection Filters in WebLogic Admin Console (Security -> Filters)
# Allow specific trusted admin IP (e.g., 192.168.1.100) and deny all other T3/T3S traffic

192.168.1.100 * * allow t3 t3s
0.0.0.0/0 * * deny t3 t3s

3. Log Audit & IoC Verification Commands

Inspect server logs for deserialization exceptions or unusual class loading patterns associated with the Coherence gadget chain.

bash

# Search WebLogic server logs for Coherence gadget chain classes and deserialization errors
grep -Ei '(ObjectInputStream|ValueExtractor|ReflectionExtractor|ChainedExtractor)' /u01/oracle/user_projects/domains/*/servers/*/logs/*.log

# Monitor active T3 connections on port 7001
netstat -an | grep 7001 | grep ESTABLISHED

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately apply the Oracle CPU patches or restrict T3 protocol access via network firewalls and connection filters.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2020-2555) is an insecure deserialization flaw (CWE-502) residing within the Oracle Coherence component (Caching, CacheStore, Invocation) of Oracle Fusion Middleware. The root cause lies in the unsafe deserialization of untrusted user input without proper validation. Specifically, certain classes within the Coherence library, such as those implementing the ValueExtractor interface, can be chained together (gadget chain) to trigger arbitrary method execution via Java Reflection during the deserialization process.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by targeting the proprietary T3 protocol used by Oracle WebLogic and Coherence for administrative and inter-server communication. Because the T3 protocol is enabled by default on port 7001, an unauthenticated attacker with network access can send a specially crafted serialized Java object containing a malicious gadget chain (utilizing ChainedExtractor and ReflectionExtractor). When the target server deserializes this incoming object, the gadget chain is executed, leading to arbitrary system command execution under the privileges of the WebLogic/Coherence process.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to enterprise infrastructure. Successful exploitation allows complete compromise of the host operating system, enabling attackers to deploy malware, exfiltrate sensitive database contents, or pivot laterally into the internal corporate network. This can result in severe operational disruption, data breaches, and loss of business continuity.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

http://packetstormsecurity.com/files/157054/Oracle-Coherence-Fusion-Middleware-Remote-Code-Execution.html

Source: secalert_us@oracle.com · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/157207/Oracle-WebLogic-Server-12.2.1.4.0-Remote-Code-Execution.html

Source: secalert_us@oracle.com · Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/157795/WebLogic-Server-Deserialization-Remote-Code-Execution.html

Source: secalert_us@oracle.com · Exploit, Third Party Advisory, VDB Entry

https://www.oracle.com/security-alerts/cpujan2020.html

Source: secalert_us@oracle.com · Vendor Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: secalert_us@oracle.com · Vendor Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: secalert_us@oracle.com · Vendor Advisory

Frequently Asked SecOps Questions (CVE-2020-2555)

FAQ

Q1. How critical is CVE-2020-2555 and is it actively exploited in the wild?

CVE-2020-2555 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2020-2555?

Primary impacted vendors include oracle across coherence, weblogic_server. Scope summary: Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0

Q3. What temporary mitigations or workarounds exist for CVE-2020-2555 before patching?

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) or restrict external access to the T3/T3S protocols (default port 7001) using connection filters Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION