Monday, June 16, 2025
HomeCVE/vulnerabilityOracle Issues Emergency Patch for Remote Code Execution Vulnerability in Oracle WebLogic...

Oracle Issues Emergency Patch for Remote Code Execution Vulnerability in Oracle WebLogic Server

Published on

SIEM as a Service

Follow Us on Google News

IT giant Oracle, on 1st November 2020, issued a Security Alert Advisory, CVE-2020-14750, regarding a remote code execution vulnerability on Oracle WebLogic Server. Oracle WebLogic Server is a Java EE application server. The latest version being WebLogic Server 14c(14.1.1) released on March 30, 2020.

Security Alert Advisory

The Security Alert offers recommendations to the vulnerability which pertains to CVE-2020-14882, addressed in October 2020, Critical Patch Update, which was remotely exploitable without any authentication. Oracle strongly recommends the users to apply the updates at the earliest.

Affected products

The affected product is the Oracle WebLogic Server wherein the following versions are affected:

- Advertisement - Google News

10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

You may take a look at the risk matrix provided by Oracle which helps to understand the versions supported.

Security alerts: Applicable Product and Version

The patches proposed in the Oracle Security alert is applicable for all the product versions which is covered under the Premier Support or Extended Support phase of the Lifetime Support Policy.

The Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Security Alert. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities. 

Attention to the Security Alert

The Cybersecurity and Infrastructure Security Agency (CISA) also published an alert on 2nd November 2020 bringing the attention of users to this patch.

Oracle has released an out-of-band security alert to address a remote code execution vulnerability—CVE-2020-14750—in Oracle WebLogic Server. A remote attacker can exploit this vulnerability to take control of an affected system.” – CISA

A quick search on Spyse, a cybersecurity search engine, reveals that there are approximately 3000+ Oracle WebLogic Servers accessible over the public internet and are vulnerable to CVE-2020-14882.

The attackers have definitely resorted to tricks instead of treats, this scary Halloween!!

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Oracle Warns Active Exploitation of Recently Patched WebLogic RCE Flaw

Oracle Critical Patch Update Addresses 405 New Security Vulnerabilities – April 2020

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Severe WSO2 SOAP Flaw Allows Unauthorized Password Resets for Any Use

A newly disclosed vulnerability, CVE-2024-6914, has shocked the enterprise software community, affecting a wide...

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent...

PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in...