CVE-2018-3245

CRITICAL

Oracle WebLogic Server <12.2.1.3 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2018-3245. PoCs published by allyshka, pyn3rd, jas502n.

AI-analyzed exploit summary This is a functional exploit for CVE-2018-3245, a deserialization vulnerability in Oracle WebLogic. It leverages JRMP (Java Remote Method Protocol) to achieve remote code execution by bypassing previous patches.

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Exploits (4)

exploitdb WORKING POC
by allyshka · javaremotemultiple
https://www.exploit-db.com/exploits/46513

This is a functional exploit for CVE-2018-3245, a deserialization vulnerability in Oracle WebLogic. It leverages JRMP (Java Remote Method Protocol) to achieve remote code execution by bypassing previous patches.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server
No auth needed
Prerequisites: Network access to the target WebLogic server · JRMP listener set up on attacker-controlled host
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 172 stars
by pyn3rd · poc
https://github.com/pyn3rd/CVE-2018-3245

This PoC exploits CVE-2018-3245, a deserialization vulnerability in Oracle WebLogic Server. It uses a custom ysoserial payload to generate a malicious serialized object, which is then sent to the target via a crafted T3 protocol request to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server
No auth needed
Prerequisites: ysoserial-cve-2018-3245.jar · network access to target WebLogic server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 14 stars
by jas502n · poc
https://github.com/jas502n/CVE-2018-3245

This repository provides a proof-of-concept exploit for CVE-2018-3245, a deserialization vulnerability in Oracle WebLogic Server. It includes a hex-encoded payload for achieving remote code execution (RCE) and obtaining a reverse shell.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server
No auth needed
Prerequisites: Network access to vulnerable WebLogic Server · Ability to send crafted serialized data
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by ianxtianxt · poc
https://github.com/ianxtianxt/CVE-2018-3245

This PoC exploits CVE-2018-3245, a deserialization vulnerability in Oracle WebLogic Server. It uses a custom ysoserial payload to generate a malicious serialized object, which is then sent to the target via a crafted T3 protocol request to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server 12.2.1.3.0, 12.2.1.2.0, 12.2.1.1.0, 10.3.6.0.0
No auth needed
Prerequisites: ysoserial-cve-2018-3245.jar · network access to target WebLogic server · T3 protocol enabled on target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105613
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041896
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/46513/

Scores

CVSS v3 9.8
EPSS 0.9428
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (3)
oracle/weblogic_server 10.3.6.0.0
oracle/weblogic_server 12.1.3.0.0
oracle/weblogic_server 12.2.1.3.0
Published Oct 17, 2018
Tracked Since Feb 18, 2026