CVE-2018-2628
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Record
CVE-2018-2628- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Record
CVE-2018-2628- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2018-14483
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Record
EUVD-2018-14483- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-882j-m7wv-38p6
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent:...
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Record
GHSA-882j-m7wv-38p6- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CISA KEV No score
Oracle WebLogic Server Unspecified Vulnerability
Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.
- Record
CVE-2018-2628- Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Oracle Weblogic Server Deserialization RCE | 2018-04-17 |
| PoC in GitHub | aedoo/CVE-2018-2628-MultiThreading | 2018-04-18 |
| PoC in GitHub | forlin/CVE-2018-2628 | 2018-04-18 |
| PoC in GitHub | jiansiting/weblogic-cve-2018-2628 | 2018-04-18 |
| PoC in GitHub | shengqi158/CVE-2018-2628 | 2018-04-18 |
| PoC in GitHub | skydarker/CVE-2018-2628 | 2018-04-18 |
| PoC in GitHub | zjxzjx/CVE-2018-2628-detect | 2018-04-18 |
| PoC in GitHub | 9uest/CVE-2018-2628 | 2018-04-19 |
| PoC in GitHub | victor0013/CVE-2018-2628 | 2018-04-19 |
| PoC in GitHub | Shadowshusky/CVE-2018-2628all | 2018-04-20 |
Show 16 moreShow less
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Oracle Weblogic Server 10.3.6.0 / 12.1.3.0 / 12.2.1.2 / 12.2.1.3 - Deserialization Remote Command Execution | 2018-04-22 |
| PoC in GitHub | tdy218/ysoserial-cve-2018-2628 | 2018-05-03 |
| PoC in GitHub | jas502n/CVE-2018-2628 | 2018-06-05 |
| PoC in GitHub | wrysunny/cve-2018-2628 | 2018-06-05 |
| PoC in GitHub | likekabin/CVE-2018-2628 | 2018-07-02 |
| Exploit-DB | Oracle Weblogic Server - Deserialization Remote Code Execution (Metasploit) | 2018-08-13 |
| PoC in GitHub | Nervous/WebLogic-RCE-exploit | 2018-09-04 |
| Exploit-DB | Oracle Weblogic Server - Deserialization Remote Command Execution (Patch Bypass) | 2018-10-25 |
| PoC in GitHub | Lighird/CVE-2018-2628 | 2018-10-30 |
| PoC in GitHub | 0xMJ/CVE-2018-2628 | 2019-01-07 |
| PoC in GitHub | daybreak-kits/weblogicScanner | 2020-01-15 |
| PoC in GitHub | seethen/cve-2018-2628 | 2020-08-07 |
| PoC in GitHub | BabyTeam1024/cve-2018-2628 | 2021-09-04 |
| PoC in GitHub | cscadoge/weblogic-cve-2018-2628 | 2022-07-27 |
| PoC in GitHub | herantong/CVE-2018-2628 | 2026-01-07 |
| Nuclei | Oracle WebLogic Server Deserialization - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation | ||
| exploits | ||
| exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-2628 is a critical vulnerability (CVSS 9.8) in Oracle Weblogic Server, published April 19, 2018. CISA lists it as known to be exploited, since September 8, 2022. EUVD reports exploitation since September 8, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.