{"id":"CVE-2015-4852","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-4852","generatedAt":"2026-10-31T22:33:41.201Z","title":"Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","published":"2015-11-18T15:59:00.000Z","lastModified":"2026-06-17T00:28:03.000Z","status":"Analyzed","sourceIdentifier":"secalert_us@oracle.com","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-502"],"affected":["oracle/virtual desktop infrastructure","oracle/storagetek tape analytics sw tool","oracle/weblogic server"],"epss":{"score":0.94991,"percentile":0.9986,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-4852"},"exploits":{"count":3,"verified":true,"firstPublished":"2016-07-20","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":46628,"kind":"exploit","title":"Oracle Weblogic Server Deserialization RCE - Raw Object (Metasploit)","url":"https://www.exploit-db.com/exploits/46628","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/46628.rb","file":"exploits/multiple/remote/46628.rb","published":"2019-03-28","added":"2019-03-28","updated":"2019-03-28","author":"Metasploit","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2015-4852"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/misc/weblogic_deserialize_rawobject.rb"},{"edbId":42806,"kind":"exploit","title":"Oracle WebLogic Server 10.3.6.0 - Java Deserialization Remote Code Execution","url":"https://www.exploit-db.com/exploits/42806","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/remote/42806.py","file":"exploits/java/remote/42806.py","published":"2017-09-27","added":"2017-09-27","updated":"2018-04-29","author":"SlidingWindow","type":"remote","platform":"java","port":null,"verified":false,"codes":["CVE-2015-4852"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":44552,"kind":"exploit","title":"Websphere/JBoss/OpenNMS/Symantec Endpoint Protection Manager - Java Deserialization Remote Code Execution","url":"https://www.exploit-db.com/exploits/44552","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/44552.sh","file":"exploits/multiple/remote/44552.sh","published":"2016-07-20","added":"2018-04-29","updated":"2018-04-29","author":"Nikhil Sreekumar","type":"remote","platform":"multiple","port":null,"verified":false,"codes":["CVE-2015-4852"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/roo7break/serialator/blob/6df65972890424eda0c780b29ca398689a7b4ca9/serialator.py"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","tags":["Exploit"],"source":"secalert_us@oracle.com"},{"url":"http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert_us@oracle.com"},{"url":"http://www.openwall.com/lists/oss-security/2015/11/17/19","tags":["Mailing List","Third Party Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["Patch"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Vendor Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["Patch","Vendor Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Patch","Vendor Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html","tags":["Vendor Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["Patch","Vendor Advisory"],"source":"secalert_us@oracle.com"},{"url":"http://www.securityfocus.com/bid/77539","tags":["Broken Link"],"source":"secalert_us@oracle.com"},{"url":"http://www.securitytracker.com/id/1038292","tags":["Broken Link"],"source":"secalert_us@oracle.com"},{"url":"https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852","tags":["Broken Link"],"source":"secalert_us@oracle.com"},{"url":"https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py","tags":["Product"],"source":"secalert_us@oracle.com"},{"url":"https://www.exploit-db.com/exploits/42806/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert_us@oracle.com"},{"url":"https://www.exploit-db.com/exploits/46628/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"secalert_us@oracle.com"},{"url":"http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2015/11/17/19","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2015-4852-2763333.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/77539","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1038292","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.py","tags":["Product"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/42806/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/46628/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-4852","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}