CVE-2023-21839

HIGH KEV NUCLEI LAB

Oracle WebLogic Server <14.1.1.0.0 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-21839 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 1, 2023. EIP tracks 9 public exploits from researchers including DXask88MA, ASkyeye, dinosn, including a Metasploit module exploits/multi/iiop/cve_2023_21839_weblogic_rce. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC exploits CVE-2023-21839, a JNDI injection vulnerability in Oracle WebLogic Server, by binding a malicious ForeignOpaqueReference object to trigger an LDAP lookup. It leverages reflection to manipulate JNDI environment variables and execute arbitrary code via a remote LDAP server.

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Exploits (9)

nomisec WORKING POC 241 stars
by DXask88MA · remote
https://github.com/DXask88MA/Weblogic-CVE-2023-21839

This PoC exploits CVE-2023-21839, a JNDI injection vulnerability in Oracle WebLogic Server, by binding a malicious ForeignOpaqueReference object to trigger an LDAP lookup. It leverages reflection to manipulate JNDI environment variables and execute arbitrary code via a remote LDAP server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
No auth needed
Prerequisites: Network access to WebLogic T3 port · LDAP server hosting malicious payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 114 stars
by ASkyeye · poc
https://github.com/ASkyeye/CVE-2023-21839

This repository contains a Go-based exploit for CVE-2023-21839, a remote code execution vulnerability in Oracle WebLogic Server. The exploit leverages IIOP/T3 protocol manipulation to achieve RCE without requiring Java dependencies, and includes NAT traversal capabilities.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
No auth needed
Prerequisites: Network access to WebLogic T3/IIOP port (typically 7001) · LDAP server controlled by attacker for payload delivery
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 62 stars
by dinosn · poc
https://github.com/dinosn/CVE-2024-20931

This is a working PoC for CVE-2024-20931, a bypass of the patch for CVE-2023-21839 in Oracle WebLogic. It exploits a JNDI injection vulnerability to achieve remote code execution by leveraging a malicious LDAP server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server (patched versions affected by CVE-2023-21839)
No auth needed
Prerequisites: Access to a vulnerable Oracle WebLogic instance · A malicious JNDI/LDAP server (e.g., JNDIExploit) · Java 8 environment
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP 27 stars
by Firebasky · poc
https://github.com/Firebasky/CVE-2023-21839

This repository provides an analysis of CVE-2023-21839, a vulnerability in Oracle WebLogic Server related to JNDI lookup/list operations over t3/iiop protocols. It includes call stack details and mentions a tool for exploitation but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Theoretical
Target: Oracle WebLogic Server
No auth needed
Prerequisites: Network access to WebLogic Server · LDAP server for payload delivery
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 18 stars
by houqe · remote
https://github.com/houqe/POC_CVE-2023-21839

This PoC exploits CVE-2023-21839, a deserialization vulnerability in Oracle WebLogic Server, by sending crafted T3 protocol messages to achieve remote code execution. The script interacts with the target server to extract keys and inject malicious LDAP references.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Complex
Reliability
Reliable
Target: Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
No auth needed
Prerequisites: Network access to the target WebLogic Server · T3 protocol enabled on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Romanc9 · poc
https://github.com/Romanc9/Gui-poc-test

This repository contains a GUI-based tool for testing and exploiting CVE-2023-21839 (WebLogic RCE), CVE-2022-39197 (CobaltStrike RCE), and CVE-2023-28432 (MinIO info leak). It includes functional PoC code for WebLogic RCE via JNDI injection and CobaltStrike RCE via Frida-based process manipulation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server, CobaltStrike, MinIO
No auth needed
Prerequisites: Java 8 for WebLogic exploit · Python 3 and Frida for CobaltStrike exploit · LDAP server for WebLogic RCE · Accessible SVG file and JAR payload for CobaltStrike RCE
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC 1 stars
by dinosn · javaremote
https://github.com/dinosn/CVE-2024-21182

This repository contains a functional exploit for CVE-2024-21182, demonstrating unauthenticated remote code execution (RCE) in Oracle WebLogic Server via T3/IIOP JNDI injection. The exploit leverages the `AggregatableOpaqueReference` gadget to bypass previous patches and trigger server-side JNDI resolution against an attacker-controlled LDAP server.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server (12.2.1.3-2018)
No auth needed
Prerequisites: Docker · Docker Compose · Java 8
devstral-2 · analyzed Jun 02, 2026 Full analysis →
nomisec SCANNER
by kw3h4 · remote
https://github.com/kw3h4/CVE-2023-21839-metasploit-scanner

This repository contains a Metasploit auxiliary module for scanning Oracle WebLogic servers vulnerable to CVE-2023-21839, an information disclosure vulnerability that can lead to RCE. The module checks the WebLogic version and attempts to verify exploitation via DNS logging.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server (versions 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
No auth needed
Prerequisites: Network access to target WebLogic server · DNS logging domain for verification
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by 4ra1n, 14m3ta7k, Grant Willcox · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb

This Metasploit module exploits CVE-2023-21839, an unauthenticated RCE vulnerability in Oracle WebLogic via IIOP deserialization of a ForeignOpaqueReference object, leading to JNDI injection and arbitrary code execution as the 'oracle' user.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
No auth needed
Prerequisites: Network access to WebLogic server on port 7001 · LDAP and HTTP servers controlled by attacker to serve malicious payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Oracle WebLogic Server - Unauthorized Access
HIGHVERIFIEDby daffainfo
Shodan: product:"oracle weblogic"

Scores

CVSS v3 7.5
EPSS 0.9981
EPSS Percentile 100.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable yes
Technical Impact partial

Lab Environment

COMMUNITY
Community Lab
docker pull vulhub/weblogic:12.2.1.3-2018
+6 more repos

Details

CISA KEV 2023-05-01
VulnCheck KEV 2023-05-01
InTheWild.io 2023-05-01
ENISA EUVD EUVD-2023-26005
CWE
CWE-306 CWE-502
Status published
Products (3)
oracle/weblogic_server 12.2.1.3.0
oracle/weblogic_server 12.2.1.4.0
oracle/weblogic_server 14.1.1.0.0
Published Jan 18, 2023
KEV Added May 01, 2023
Tracked Since Feb 18, 2026