Wenhui Wang

**Name of the Vulnerable Software and Affected Versions** Oracle WebLogic Server versions 12.2.1.4.0 through 14.1.1.0.0 **Description** The issue is related to errors in handling input data in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to execute arbitrary code by injecting specially crafted messages via T3 and IIOP protocols. Successful attacks can result in the takeover of the Oracle WebLogic Server. **Recommendations** For versions 12.2.1.4.0 and 14.1.1.0.0, consider restricting access to the T3 and IIOP protocols until a patch is available. As a temporary workaround, consider disabling the Core component of the Oracle WebLogic Server until a patch is available. Avoid using the Oracle WebLogic Server for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.