Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2019-04-26

CVE-2019-2725

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  1. First PoC
  2. 2549 days →Metasploit
  3. 178 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-01-10 · due 2022-07-10 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

4 known · links only

Metasploit1

  1. Oracle Weblogic Server Deserialization RCE - AsyncResponseService ↗

    An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a malicious SOAP request to the interface WLS AsyncResponseService to execute code on the vulnerable host.

    ruby · seen 2026-10-18

Exploit-DB2

  1. Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution ↗

    created 2019-04-30

  2. Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit) ↗

    created 2019-05-08

Nuclei1

  1. Oracle WebLogic Server - Remote Command Execution ↗

    The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.