--- id: CVE-2019-2725 title: >- Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) summary: >- Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated a… severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-74 vendor: oracle product: agile_product_lifecycle_management affected: - agile_product_lifecycle_management = 9.3.3 - agile_product_lifecycle_management = 9.3.4 - agile_product_lifecycle_management = 9.3.5 - communications_converged_application_server = 5.1 - communications_converged_application_server = 7.0 - communications_converged_application_server = 7.1 - peoplesoft_enterprise_peopletools = 8.56 - peoplesoft_enterprise_peopletools = 8.57 - peoplesoft_enterprise_peopletools = 8.58 - storagetek_tape_analytics_sw_tool = 2.3 - tape_library_acsls = 8.5 - tape_virtual_storage_manager_gui = 6.2 - vm_virtualbox < 5.2.36 - 'vm_virtualbox >= 6.0.0, < 6.0.16' - 'vm_virtualbox >= 6.1.0, < 6.1.2' - vm_virtualbox = 5.2.36 - weblogic_server = 10.3.6.0.0 - weblogic_server = 12.1.3.0.0 patched: - vm_virtualbox 6.1.2 published: '2019-04-26' updated: '2026-10-01' sourceUpdated: '2026-10-01T21:17:15.087' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-2725' references: - url: >- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html label: secalert_us@oracle.com - url: >- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html label: secalert_us@oracle.com - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: secalert_us@oracle.com - url: 'http://www.securityfocus.com/bid/108074' label: secalert_us@oracle.com - url: 'https://support.f5.com/csp/article/K90059138' label: secalert_us@oracle.com - url: 'https://www.exploit-db.com/exploits/46780/' label: secalert_us@oracle.com - url: >- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW label: secalert_us@oracle.com - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: secalert_us@oracle.com - url: >- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html label: af854a3a-2127-422b-91ae-364da2661108 - url: >- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/108074' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.f5.com/csp/article/K90059138' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.exploit-db.com/exploits/46780/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-2725 label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 tags: - nvd - kev - in-the-wild - exploit-available - cve.org - score-dispute epss: 0.99977 epssPercentile: 0.99979 kev: true kevDateAdded: '2022-01-10' kevDueDate: '2022-07-10' kevRansomware: true exploited: true exploits: exploitdb: true github: 19 githubRepos: - 'https://github.com/shack2/javaserializetools' - 'https://github.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961' - 'https://github.com/lasensio/cve-2019-2725' metasploit: - exploit/multi/misc/weblogic_deserialize_asyncresponseservice nuclei: - CVE-2019-2725 checkedAt: '2026-10-26T21:40:32.628Z' exploitAvailable: true ssvc: exploitation: active automatable: 'yes' technicalImpact: total timestamp: '2026-08-12T03:55:17.934499Z' scores: nvd: 9.8 cna: 7.5 ingestedAt: '2026-08-12T05:52:07.052Z' --- ## Overview Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). ## Affected - `agile_product_lifecycle_management = 9.3.3` - `agile_product_lifecycle_management = 9.3.4` - `agile_product_lifecycle_management = 9.3.5` - `communications_converged_application_server = 5.1` - `communications_converged_application_server = 7.0` - `communications_converged_application_server = 7.1` - `peoplesoft_enterprise_peopletools = 8.56` - `peoplesoft_enterprise_peopletools = 8.57` - `peoplesoft_enterprise_peopletools = 8.58` - `storagetek_tape_analytics_sw_tool = 2.3` - `tape_library_acsls = 8.5` - `tape_virtual_storage_manager_gui = 6.2` - `vm_virtualbox < 5.2.36` - `vm_virtualbox >= 6.0.0, < 6.0.16` - `vm_virtualbox >= 6.1.0, < 6.1.2` - `vm_virtualbox = 5.2.36` - `weblogic_server = 10.3.6.0.0` - `weblogic_server = 12.1.3.0.0` ## Remediation Upgrade past the affected range: - `vm_virtualbox 6.1.2`