Oracle WebLogic Unsupported Version Detection

Tenable plugin 109345 is not a CVE. It is a *lifecycle* finding: the scanner identified an Oracle WebLogic Server instance running a release family that has aged out of Oracle Premier and Extended Support (historically 10.3.x / 11g, 12.1.x, and increasingly 12.2.1.3/12.2.1.4 as their support windows close). Oracle ships WebLogic security fixes only through the quarterly Critical Patch Update (CPU) stream, and only for in-support versions. Once a release leaves that stream, any new WebLogic CVE — and WebLogic has had a *long* list of unauth pre-auth RCEs (CVE-2017-10271, 2019-2725, 2020-2883, 2020-14882, 2023-21839, 2024-20931 to name a few) — will never get a vendor patch on your box.

Tenable's CRITICAL label is *directionally correct but lazy*. The plugin itself has no exploit; it's a sticker. The real risk is the expected value of all future unpatched WebLogic CVEs over the asset's remaining lifetime, which on a product with WebLogic's exploit history is enormous. We rate this HIGH (8.5) rather than CRITICAL because severity depends entirely on network exposure and what the instance hosts — an internet-reachable unsupported WebLogic is effectively a 10.0; an air-gapped lab instance is a 4.

Why this verdict

• Lifecycle, not lottery: Unlike a single CVE, this finding *guarantees* future exploitability — every new WebLogic CPU adds another permanently-unpatched RCE to your asset.
• Back catalog is loaded: 6+ KEV-listed WebLogic RCEs already work against EOL builds with public PoCs and Metasploit modules.
• Role multiplier: WebLogic in its canonical role (Java EE app tier fronting Oracle DB, often AD-integrated) means a successful chain ends in datasource credential theft and lateral movement to the data tier — fleet-relevant outcome, hence HIGH floor.
• Friction adjustment downward: Many WebLogic instances are internal-only behind reverse proxies, which narrows the exploitable population versus a true 10.0 internet-wide bug.
• No vendor remediation pathway: The only fix is migration to 14.1.2, which is a project, not a patch — increasing the residency time of the risk.

Why not higher?

We hold at HIGH rather than CRITICAL because the plugin itself is a *condition*, not an active exploit chain — actual exploitability depends on network reachability and which specific endpoints (/console, T3, IIOP) are exposed. An internet-facing instance should be elevated to CRITICAL on a per-asset basis.

Why not lower?

MEDIUM would imply this is hygiene. It is not — unsupported WebLogic has an unbroken decade-long history of mass exploitation, the back catalog of unpatched RCEs grows every Oracle CPU, and a single compromised appserver typically leads to DB and AD compromise.

1. Inventory and triage every WebLogic instance by exposure tier — Within the noisgate mitigation SLA of 30 days, classify each instance as Internet-exposed / DMZ / internal / isolated. Internet-exposed instances on EOL versions are de-facto CRITICAL — treat as already-compromised, do IR triage first.
2. Remove internet exposure immediately — Put unsupported WebLogic behind an authenticating reverse proxy (or VPN-gate it) within 3 days for any externally reachable instance. Block direct access to /console, /em, /wls-wsat/, /_async/, /clusterjsp/ paths at the proxy/WAF.
3. Restrict T3/T3s/IIOP protocol access — Configure weblogic.security.net.ConnectionFilterImpl to allow T3 only from known management subnets. T3 is the carrier for most deserialization RCEs; closing it breaks a huge fraction of the exploit catalog.
4. Apply latest *available* Oracle CPU even if EOL — If your support contract still grants Extended Support or Sustaining patches, install them. Within 30 days, also harden via Oracle's deserialization blocklist (weblogic.oif.serialFilter) if your version supports it.
5. Plan migration to WebLogic 14.1.2 or alternative platform — This is the only true remediation. Target 180-day remediation for HIGH-rated instances; bring forward to 90 days for any internet-exposed ones (treat them as CRITICAL per the SLA table).
6. Wrap with EDR + JVM child-process alerting — Tune EDR to alarm on java.exe/java spawning cmd.exe, powershell, bash, sh, whoami, nslookup, or writing executable/JSP content into WebLogic tmp dirs. Highest-fidelity tripwire for live exploitation.

Run on the target Windows host (or adapt for Linux by reading the same files via bash). Invoke as: .\Check-WeblogicEOL.ps1 -DomainHome 'C:\Oracle\Middleware\Oracle_Home\user_projects\domains\base_domain'. Requires read access to the WebLogic install directory — typically run as a local administrator or the WebLogic service account.

#requires -Version 5
<#
.SYNOPSIS
  Detects Oracle WebLogic versions that are out of vendor support.
.PARAMETER DomainHome
  Path to a WebLogic domain. If omitted, attempts auto-discovery under C:\Oracle.
.OUTPUTS
  VULNERABLE | PATCHED | UNKNOWN
#>
param(
  [string]$DomainHome = ''
)

$ErrorActionPreference = 'Stop'

# Released-and-supported family floor as of 2026-06-25.
# Anything < 14.1.2.0 is either EOL or rapidly approaching it.
$supportedFloor = [Version]'14.1.2.0'

function Get-WeblogicVersion {
  param([string]$home)
  $candidates = @(
    Join-Path $home 'registry.xml',
    (Join-Path $home '..\..\..\..\inventory\registry.xml'),
    (Join-Path $home '..\..\..\..\OPatch\config\inventory.xml')
  )
  foreach ($f in $candidates) {
    if (Test-Path $f) {
      $txt = Get-Content -Raw $f
      if ($txt -match 'WebLogic Server.*?(\d+\.\d+\.\d+(?:\.\d+)?)') {
        return $Matches[1]
      }
    }
  }
  # Fallback: run weblogic.version via java
  $wljar = Get-ChildItem -Path 'C:\Oracle' -Recurse -Filter 'weblogic.jar' -ErrorAction SilentlyContinue | Select-Object -First 1
  if ($wljar) {
    try {
      $out = & java -cp $wljar.FullName weblogic.version 2>&1
      if ($out -match 'WebLogic Server\s+(\d+\.\d+\.\d+(?:\.\d+)?)') { return $Matches[1] }
    } catch {}
  }
  return $null
}

if (-not $DomainHome) {
  $found = Get-ChildItem 'C:\Oracle' -Recurse -Directory -Filter 'domains' -ErrorAction SilentlyContinue | Select-Object -First 1
  if ($found) { $DomainHome = (Get-ChildItem $found.FullName -Directory | Select-Object -First 1).FullName }
}

if (-not $DomainHome -or -not (Test-Path $DomainHome)) {
  Write-Output 'UNKNOWN: no WebLogic domain located'
  exit 2
}

$ver = Get-WeblogicVersion -home $DomainHome
if (-not $ver) {
  Write-Output 'UNKNOWN: could not determine WebLogic version'
  exit 2
}

try { $v = [Version]$ver } catch { Write-Output "UNKNOWN: unparseable version $ver"; exit 2 }

if ($v -lt $supportedFloor) {
  Write-Output "VULNERABLE: WebLogic $ver is past Oracle support (floor $supportedFloor)"
  exit 1
} else {
  Write-Output "PATCHED: WebLogic $ver is in supported family"
  exit 0
}

Sources

1. Tenable Plugin 109345
2. Oracle Lifetime Support Policy — Fusion Middleware
3. Oracle Critical Patch Updates
4. CISA KEV Catalog (search 'WebLogic')
5. CVE-2020-14882 — WebLogic console RCE
6. CVE-2023-21839 — WebLogic T3/IIOP JNDI
7. WebLogic ConnectionFilterImpl hardening guide
8. Unit42 / Kinsing WebLogic exploitation reporting