CVE-2018-3191

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.09.8Critical EPSS percentile99th63% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2018-10-17Updated 2024-11-21Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Oracle Corporation WebLogic ServerAffected: 10.3.6.0Upgrade to: not statedAffected: 12.1.3.0Upgrade to: not statedAffected: 12.2.1.3Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run WebLogic Server and whether its version is 10.3.6.0, 12.1.3.0, or 12.2.1.3.
Check whether the server's T3 service can be reached from untrusted networks, especially the internet.
Apply Oracle's October 2018 security update; the supplied remediation information does not specify an exact fixed version number, so confirm the correct patched release for your WebLogic branch with Oracle or your support provider.
Until patched, restrict T3 access to only trusted application hosts using network firewall rules.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

In plain language

Written by AI from the record

WebLogic Server versions 10.3.6.0, 12.1.3.0, and 12.2.1.3 have a serious remote takeover flaw, so a typical small business using one should act urgently.

Unauthenticated remote compromise of Oracle WebLogic Server WLS Core Components via network access to the T3 protocol can result in full application-server control.

If you're affected

Full server takeover
Customer data theft
Data tampering
Service outages
Ransomware risk

What is it

This is a weakness in WebLogic Server that can let an outsider take control of the server from the network. It is like leaving a building's master-control room accessible through a service entrance: an intruder could read records, change them, or shut down operations.

Who is affected

This matters to you if your business runs WebLogic Server, including as part of a business application managed by a vendor or hosting provider. It is a risk when an attacker can reach the server's T3 network service; they do not need a login or anyone to click anything.

How urgent is it

Publicly available attack code exists, and this flaw can give an attacker complete control of an exposed server without credentials. Treat this as a red-priority issue: identify exposed systems now and arrange the vendor update immediately.

What to do — in detail

Confirm the installed WebLogic Server release and identify all listeners exposing the T3 protocol, including load-balanced, disaster-recovery, and vendor-managed instances. The affected branches identified in the supplied information are 10.3.6.0, 12.1.3.0, and 12.2.1.3.

Apply the Oracle Critical Patch Update issued in October 2018 for the applicable WebLogic branch. The supplied patch finding links to Oracle's advisory but does not provide branch-specific fixed build numbers; obtain those target versions from Oracle support or the advisory before scheduling deployment. No upgrade-path or breaking-change information was provided.

If patching is delayed, block T3 from the internet and untrusted internal networks, allowing it only between documented WebLogic hosts that require it. Review server and network logs for unexpected T3 connections, new administrative activity, unusual processes, changed application content, and suspicious outbound traffic. CVE-2018-3191 is not listed in CISA's Known Exploited Vulnerabilities catalog, so no CISA remediation due date is provided.

Technical context

CVSS v3.0 score: 9.8 (Critical), with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impact. CORE reports an unauthenticated network attack through T3 in WLS Core Components, reachable in the default configuration, capable of complete application-server compromise. A public GitHub proof of concept is known. EPSS estimates a 63.2% likelihood (99th percentile) and reports a falling trend; this is predictive, not confirmation of exploitation. CISA KEV does not list this CVE, and no dated news finding confirms exploitation in the wild. CWE classification is not provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

63% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band changemoderate → highepss band change
2026-09-21EPSS band changehigh → moderateepss band change
2026-09-06EPSS band changemoderate → highepss band change
2026-09-05EPSS band changehigh → moderateepss band change
2026-08-31EPSS band changemoderate → highepss band change
2026-08-28EPSS band changehigh → moderateepss band change

Affected products

Oracle Corporationcommercial · USaka Oracle Corp., oracle
- WebLogic ServerOn-premDatabases / cache-message-queue

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

NVD-CWE-noinfoNo name in the record

Sources

References in the record

And 1 more reference. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for WebLogic Server, not every advisory. This one: public exploit.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account