Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2019-2725

critical CISA KEV

Oracle WebLogic Server, Injection

Vendor / product: Oracle — WebLogic Server

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2019-04-26 19:29
Modified: 2026-10-01 21:17
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Listed in CISA KEV
Added 2022-01-10 · due 2022-07-10
Known ransomware use: Known

Required action (CISA)

Apply updates per vendor instructions.

Affected products

oracle / agile_product_lifecycle_management 9.3.3, 9.3.4, 9.3.5
oracle / communications_converged_application_server 5.1, 7.0, 7.1
oracle / peoplesoft_enterprise_peopletools 8.56, 8.57, 8.58
oracle / storagetek_tape_analytics_sw_tool 2.3
oracle / tape_library_acsls 8.5
oracle / tape_virtual_storage_manager_gui 6.2
oracle / vm_virtualbox <5.2.36, ≥6.0.0 <6.0.16, ≥6.1.0 <6.1.2, 5.2.36
oracle / weblogic_server 10.3.6.0.0, 12.1.3.0.0

Weakness classification (CWE)

CWE-74

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
Vendor advisory: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Vendor advisory: https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW
Vendor advisory: https://www.oracle.com/security-alerts/cpujan2020.html
Vendor advisory: http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
Vendor advisory: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Vendor advisory: https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW
Vendor advisory: https://www.oracle.com/security-alerts/cpujan2020.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch / mitigation: https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2020.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch / mitigation: https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2020.html

References

Data sources

CISA KEV — fetched 2026-10-27 06:50 UTC · record ↗
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-101497CVE-2026-101488CVE-2026-91263CVE-2026-101423CVE-2026-101425