{"id":"CVE-2023-21839","kind":"vulnerability","aliases":["CVE-2023-21839"],"related":[],"title":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle WebLogic Server has an unspecified flaw reachable over the T3 and IIOP protocols. An unauthenticated attacker with network access can compromise the server.","severity":"critical","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2023-05-01T00:00:00+00:00","products":[{"name":"Oracle WebLogic Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"oracle weblogic server","fixed":[],"affected":"= 12.2.1.3.0","ecosystem":"vendor"},{"name":"oracle weblogic server","fixed":[],"affected":"= 12.2.1.4.0","ecosystem":"vendor"},{"name":"oracle weblogic server","fixed":[],"affected":"= 14.1.1.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","oracle","runtime","self-hosted","weblogic"],"not_affected_if":["no-t3-iiop-exposure"],"how_to_check":null,"fix":"Apply the Oracle security updates for WebLogic Server per vendor instructions; the specific patched versions are not in the sources.","status":"open","published_at":"2023-01-18T00:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:51+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T21:06:51Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle security updates for WebLogic Server per vendor instructions; the specific patched versions are not in the sources.","reach":"network","impact":"high","summary":"Oracle WebLogic Server has an unspecified flaw reachable over the T3 and IIOP protocols. An unauthenticated attacker with network access can compromise the server.","category":"runtime","who_cares":["weblogic","oracle","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker compromises the WebLogic server over T3 or IIOP.","analyst_note":"Find Oracle's Critical Patch Update advisory for April 2023 and list the fixed WebLogic versions and the T3/IIOP filtering guidance.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-t3-iiop-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000456,"input_tokens":2808,"output_tokens":351,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':15A,18A '-21839':16A,19A '/av':138C '12.2.1.3.0':83C '12.2.1.4.0':84C '14.1.1.0.0':86C '3.1':128C,137C '7.5':131C 'access':59B,95C,113C,119C,125C 'affect':81C 'allow':90C 'attack':56B,92C,105C 'base':129C 'complet':118C 'compon':12A,75C 'compromis':61B,100C 'confidenti':132C 'core':13A,76C 'critic':115C 'cve':14A,17A 'cvss':127C,134C,136C 'data':116C,126C 'easili':87C 'exploit':32B,88C 'flaw':46B 'fusion':10A,73C 'h/i':144C 'host':38B 'iiop':52B,98C 'impact':133C 'java':33B 'l/pr':140C 'middlewar':11A,74C 'n':146C 'n/a':145C 'n/ac':139C 'n/s':142C 'n/ui':141C 'network':58B,94C 'oracl':4A,9A,34B,40B,67C,72C,101C,122C 'oracle':20A,23A,26A,29A 'product':7A,70C 'protocol':53B 'reachabl':47B 'result':110C 'runtim':35B 'score':130C 'self':37B 'self-host':36B 'server':6A,22A,25A,28A,31A,42B,63B,69C,103C,124C 'success':104C 'support':77C 't3':50B,97C 'u/c':143C 'unauthent':55B,91C 'unauthor':112C 'unspecifi':45B 'vector':135C 'version':78C 'via':96C 'vulner':1A,64C,89C,108C 'weblog':5A,39B,41B,68C,102C,123C 'weblogic':21A,24A,27A,30A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-01-18T00:15:13+00:00","kev":{"dateAdded":"2023-05-01","dueDate":"2023-05-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-21839","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-21839","severity":null,"published_at":"2023-05-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-21839","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-21839","severity":null,"published_at":"2023-01-18T00:15:13+00:00","modified_at":"2026-06-17T05:34:09+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}