CVEs / CVE-2018-2628

CVE-2018-2628: Oracle WebLogic Server Unspecified Vulnerability

• Known exploited in the CISA KEV catalog since 8 Sep 2022
• critical 9.8 CVSS 3.1 (NVD)
• EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
• Last changed at its sources 17 Jun 2026

Summary

Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected and fixed versions

Exploitation

Severity

References

• CVE-2018-2628 on NVD
• CVE-2018-2628 in the CISA KEV catalog
• https://www.oracle.com/security-alerts/cpuapr2018.html (cited by CISA)
• http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch, Vendor Advisory
• http://www.securityfocus.com/bid/103776 Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040696 Broken Link, Third Party Advisory, VDB Entry
• https://github.com/brianwrf/CVE-2018-2628 Broken Link
• https://www.exploit-db.com/exploits/44553/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/45193/ Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/46513/ Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2628 US Government Resource