Cyber Resilience

CVE-2020-14841

Oracle Weblogic Server 10.3.6.0.0 … 14.1.1.0.0

High EPSS
Published
21 October 2020
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.52 99th percentile
Risk Priority 85 floored blend · peak EPSS

Summary

CVE-2020-14841 is a critical-severity an unspecified weakness vulnerability in Oracle Weblogic Server. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic…

more

Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated network attack via IIOP directly enables exploitation of a public-facing WebLogic Server application.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Successful exploitation results in full server takeover, indicating privilege escalation to system-level control.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2023-22072Same product: Oracle Weblogic Server
CVE-2018-3191Same product: Oracle Weblogic Server
CVE-2021-2394Same product: Oracle Weblogic Server
CVE-2024-20927Same product: Oracle Weblogic Server
CVE-2026-35298Same product: Oracle Weblogic Server
CVE-2026-60202Same product: Oracle Weblogic Server
CVE-2026-60203Same product: Oracle Weblogic Server
CVE-2017-10271Same product: Oracle Weblogic Server
CVE-2024-21216Same product: Oracle Weblogic Server
CVE-2026-60196Same product: Oracle Weblogic Server

Affected Assets

oracle
weblogic server
10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References