Oracle Fusion Middleware Unspecified Vulnerability (CVE-2020-2551)
Severity: critical · Patch status: patched · Since 2023-11-16 · CVE-2020-2551
Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server. CISA added CVE-2020-2551 to its Known Exploited Vulnerabilities catalog on Nov 16, 2023, which means attackers are exploiting it in the wild.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Dec 7, 2023 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
