CVE-2015-4852: Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 96% chance of exploitation in the next 30 days.

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.

Affected products

• Oracle Storagetek Tape Analytics Sw Tool: version 2.3 only
• Oracle Virtual Desktop Infrastructure: up to and including 3.5.2
• Oracle WebLogic Server: version 10.3.6.0.0 only; version 12.1.2.0.0 only; version 12.1.3.0.0 only; version 12.2.1.0.0 only

Published 2015-11-18. Last modified 2026-06-17.