CVE-2023-21839

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-502 CWE-306

Affected software

Vendor	Product	Versions
Oracle Corporation	WebLogic Server	12.2.1.3.0; 12.2.1.4.0; 14.1.1.0.0

References

http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpujan2023.htmlPatch, Vendor Advisory
http://packetstormsecurity.com/files/172882/Oracle-Weblogic-PreAuth-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpujan2023.htmlPatch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21839US Government Resource

Timeline

Published: Jan 18, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: May 1, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-21846.1The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the s CVE-2023-218404.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected are 5.7.40 and prio CVE-2023-218417.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are CVE-2023-218427.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are aff CVE-2023-218433.7Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions tha CVE-2023-218445.4Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Supported versions that ar CVE-2023-218455.4Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). The supported version th CVE-2023-218468.8Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions that are affected ar CVE-2023-218475.4Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Download). Supported version CVE-2023-218488.8Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). The CVE-2023-218497.5Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affect CVE-2023-218507.5Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). Supported versio