CISA warns of critical Oracle flaw actively exploited
Take action: If you are running Oracle WebLogic and it's not patched since 2020, you are a ripe target for hackers. Even if you had all the arguments to postpone patching, consider them moot. Patch, because you will be hacked.
Learn More
CISA reprots of an actively exploited vulnerability in Oracle WebLogic Server product. Federal Civilian Executive Branch (FCEB) agencies must apply necessary patches by January 28, 2025.
Vulnerability summary
- CVE-2020-2883 (CVSS score 9.8) - Exploitable by unauthenticated attackers with network access via IIOP or T3 protocols.
Oracle had previously warned about attempted exploitation of this vulnerability in April 2020. Specific details about exploitation attempts, threat actors, and their targets are not disclosed. Users should update their Oracle WebLogic servers ASAP.
