{"id":"CVE-2020-2555","kind":"vulnerability","aliases":["CVE-2020-2555"],"related":[],"title":"Oracle Multiple Products: Oracle Multiple Products Remote Code Execution Vulnerability","description":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Several Oracle products, including Oracle Coherence, Oracle Utilities Framework, Oracle Commerce and Oracle Communications DSR, have a remote code execution flaw reachable over the T3 or HTTP protocol. An unauthenticated attacker with network access can take over the affected system, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":0.97116,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Oracle Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["coherence","commerce","dsr","exploited","oracle","utilities-framework","vendor","weblogic"],"not_affected_if":["no-t3-or-http-exposure","unaffected-products-only"],"how_to_check":"Identify Oracle Coherence, Utilities Framework, Retail Assortment Planning, Commerce or Communications DSR in your estate and confirm the patch level against Oracle's Critical Patch Update advisory for 2020.\nCheck whether the T3 or HTTP listener of the affected WebLogic/Coherence component is reachable from untrusted networks.","fix":"Apply the update for each affected Oracle product per Oracle's vendor instructions (CISA required action: apply updates per vendor instructions).\nUntil patched, restrict network access to T3 and HTTP ports to trusted hosts only.","status":"open","published_at":"2020-01-15T17:15:17+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:49+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:41:49Z","model":"claude-haiku-5-5","output":{"fix":"Apply the update for each affected Oracle product per Oracle's vendor instructions (CISA required action: apply updates per vendor instructions).\nUntil patched, restrict network access to T3 and HTTP ports to trusted hosts only.","reach":"internet","impact":"high","summary":"Several Oracle products, including Oracle Coherence, Oracle Utilities Framework, Oracle Commerce and Oracle Communications DSR, have a remote code execution flaw reachable over the T3 or HTTP protocol. An unauthenticated attacker with network access can take over the affected system, and CISA lists it as actively exploited.","category":"vendor","who_cares":["oracle","coherence","weblogic","utilities-framework","commerce","dsr"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code and takes over the server.","analyst_note":"Sources do not give affected or fixed versions or the exact configuration needed; check Oracle's Critical Patch Update April 2020 advisory for product-specific patch versions and default T3 exposure.","how_to_check":"Identify Oracle Coherence, Utilities Framework, Retail Assortment Planning, Commerce or Communications DSR in your estate and confirm the patch level against Oracle's Critical Patch Update advisory for 2020.\nCheck whether the T3 or HTTP listener of the affected WebLogic/Coherence component is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["unaffected-products-only","no-t3-or-http-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000585,"input_tokens":2926,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':12A,15A '-2555':13A,16A '/av':143C '12.1.3.0.0':98C '12.2.1.3.0':99C '12.2.1.4.0':101C '3.0':130C,142C '3.7.1.0':97C '9.8':133C 'access':63B,110C 'activ':75B 'affect':68B,95C 'allow':105C 'attack':60B,107C,118C 'avail':137C 'base':131C 'cach':88C 'cachestor':89C 'cisa':71B 'code':8A,48B 'coher':20B,35B,81C,116C,128C 'commerc':21B,40B 'communic':43B 'compon':87C 'compromis':114C 'confidenti':134C 'cve':11A,14A 'cvss':129C,139C,141C 'dsr':22B,44B 'easili':102C 'execut':9A,49B 'exploit':23B,76B,103C 'flaw':50B 'framework':27B,38B 'fusion':85C 'h':151C 'h/a':150C 'h/i':149C 'http':56B 'impact':138C 'includ':33B 'integr':135C 'invoc':90C 'l/pr':145C 'list':72B 'middlewar':86C 'multipl':2A,5A 'multiple':18A 'n/ac':144C 'n/s':147C 'n/ui':146C 'network':62B,109C 'oracl':1A,4A,24B,31B,34B,36B,39B,42B,80C,84C,115C,127C 'oracle':17A 'product':3A,6A,32B,82C 'products':19A 'protocol':57B 'reachabl':51B 'remot':7A,47B 'result':123C 'score':132C 'sever':30B 'success':117C 'support':91C 'system':69B 't3':54B,112C 'take':65B 'takeov':125C 'u/c':148C 'unauthent':59B,106C 'util':26B,37B 'utilities-framework':25B 'vector':140C 'vendor':28B 'version':92C 'via':111C 'vulner':10A,77C,104C,121C 'weblog':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-01-15T17:15:17+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-2555","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2555","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2020-2555","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-2555","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-2555","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-2555","severity":null,"published_at":"2020-01-15T17:15:17+00:00","modified_at":"2026-06-17T03:12:20+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}