Live › vulnerability › CVE-2015-4852
Go to dashboardOracle WebLogic Server has a deserialization flaw in its bundled Apache Commons code that lets a remote attacker send crafted serialized data. An attacker can run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle WebLogic Server | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
This page as .md · .json · in your agent: get_signal("CVE-2015-4852")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.