$ cve CVE-2021-2109 JSON

CVE-2021-2109 EXPLOIT

7.2

HIGH · CVSS 3.1 · EPSS 70.4% (pctl 99)

Patch early

A public exploit exists.

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Scoring

CVSS	7.2 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS	70.45% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2021-01-20
Last modified	2026-06-17

Affected (1)

Vendor	Product
oracle	weblogic server

Public exploits

Source	Title	Date
exploit-db	Oracle WebLogic Server 14.1.1.0 - RCE (Authenticated)	2021-01-22

References

→ the Explorer · watch your stack · NVD