---
id: "CVE-2020-2555"
kind: "vulnerability"
aliases: ["CVE-2020-2555"]
title: "Oracle Multiple Products: Oracle Multiple Products Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.97116
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Oracle Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["coherence", "commerce", "dsr", "exploited", "oracle", "utilities-framework", "vendor", "weblogic"]
not_affected_if: ["no-t3-or-http-exposure", "unaffected-products-only"]
published_at: "2020-01-15T17:15:17+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:34+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2555", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-2555", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2555", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Oracle Multiple Products: Oracle Multiple Products Remote Code Execution Vulnerability

Several Oracle products, including Oracle Coherence, Oracle Utilities Framework, Oracle Commerce and Oracle Communications DSR, have a remote code execution flaw reachable over the T3 or HTTP protocol. An unauthenticated attacker with network access can take over the affected system, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Multiple Products affected ? fixed ?

## How to check

Identify Oracle Coherence, Utilities Framework, Retail Assortment Planning, Commerce or Communications DSR in your estate and confirm the patch level against Oracle's Critical Patch Update advisory for 2020.
Check whether the T3 or HTTP listener of the affected WebLogic/Coherence component is reachable from untrusted networks.

## Fix

Apply the update for each affected Oracle product per Oracle's vendor instructions (CISA required action: apply updates per vendor instructions).
Until patched, restrict network access to T3 and HTTP ports to trusted hosts only.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2555
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-2555
- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-2555

## From the sources

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_