Oracle WebLogic Server

The January 2022 Oracle Critical Patch Update bundles roughly two dozen WebLogic fixes against versions 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. The headline issues are CVE-2022-21306 (T3/IIOP core deserialization, unauthenticated, network-reachable, CVSSv3 9.8), CVE-2022-21371 (Web Container local file inclusion / path traversal, now CISA KEV-listed with a Feb 13 2025 due date), and CVE-2022-21292 in the Samples component. The Tenable plugin also chains in the tail end of the Log4Shell family — *CVE-2021-44832* and *CVE-2021-4104* — both of which WebLogic ships with.

Tenable rates the bundle HIGH (CVSSv3 7.5) because that's the score of the *least-bad* covered CVE. That undersells reality. The actual ceiling here is the T3 deserialization RCE plus a KEV-listed file-read primitive on a product whose attack surface has been continuously exploited (CVE-2017-10271, CVE-2019-2725, CVE-2020-14882, CVE-2020-2883, CVE-2023-21839) by every commodity botnet and ransomware affiliate for the last eight years. Vendor severity is understated — this is a CRITICAL on any WebLogic host carrying production workloads.

Why this verdict

• KEV-listed: CVE-2022-21371 is on CISA's Known Exploited Vulnerabilities catalog — federal due date already lapsed, meaning real campaigns observed in the wild.
• Unauth network RCE in same bundle: CVE-2022-21306 is a T3/IIOP deserialization RCE with CVSS 9.8 and public PoCs; Tenable's HIGH rating reflects the weakest CVE, not the worst.
• Role multiplier: WebLogic is the canonical Java EE app server for Oracle EBS, PeopleSoft, and bespoke enterprise apps — the chain ends in datasource credential theft and DB compromise, not a single-host pop. Floor is CRITICAL.
• Friction is moderate, not high: T3 is often filtered externally but rarely between internal tiers; the LFI alternative works over plain HTTP and bypasses T3 hardening entirely.
• Continuous exploitation history: WebLogic has been the persistent favorite of Kinsing, 8220 Gang, TeamTNT and LockBit affiliates — patch lag here gets you owned.

Why not higher?

There is no higher bucket than CRITICAL. The reassessed numeric score is held at 9.1 rather than 9.8 because the worst single CVE (T3 deserialization) often requires internal positioning when T3 is properly filtered at the edge.

Why not lower?

Downgrading to HIGH would ignore the KEV listing and the unauth RCE in the same bundle. Any WebLogic instance carrying production data is a high-value-role host by definition, so the deployment-role floor is CRITICAL regardless of network friction.

1. Block T3/T3s and IIOP at the perimeter and between trust zones — Configure weblogic.security.net.ConnectionFilterImpl to deny T3/T3s/IIOP from anything but the admin VLAN. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Restrict /console and /em to a jump-host VLAN — Front WebLogic with an reverse proxy or NGFW rule that exposes only the application contexts and blocks /console, /em, /wls-wsat, /_async/. Same 3-day window.
3. Deploy WAF signatures for known WebLogic exploit URIs — Block ..%2f, double-encoded traversal, and known T3 magic bytes. F5, Akamai, AWS WAF, and ModSecurity all ship rule packs for WebLogic CVE classes.
4. Rotate WebLogic admin passwords and datasource credentials — If you suspect exposure window, assume SerializedSystemIni.dat was read and admin creds leaked. Rotate before patching to invalidate any previously stolen secrets.
5. Hunt for webshells and miner persistence — Search WebLogic deployment dirs for unexpected WAR/JSP files; review AdminServer.log for app deployment events from off-hours; check cron and systemd for Kinsing-class persistence.

Run on each WebLogic middle-tier host as the oracle (or whichever) WebLogic owner. Invoke as ./check_wls_jan2022_cpu.sh /u01/app/oracle/middleware. Requires read access to the WL home and registry.xml.

#!/usr/bin/env bash
# noisgate verifier: Oracle WebLogic Server Jan 2022 CPU (Tenable 157127)
# Usage: ./check_wls_jan2022_cpu.sh <WL_HOME>
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
WL_HOME="${1:-/u01/app/oracle/middleware}"
REG="$WL_HOME/inventory/registry.xml"

if [[ ! -f "$REG" ]]; then
  echo "UNKNOWN: registry.xml not found at $REG"
  exit 2
fi

# Extract WL base version
VER=$(grep -oE 'name="WebLogic Server"[^>]*version="[0-9.]+"' "$REG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
echo "WebLogic version: ${VER:-unknown}"

case "$VER" in
  12.1.3.0.0|12.2.1.3.0|12.2.1.4.0|14.1.1.0.0) ;;
  "") echo "UNKNOWN: cannot parse version"; exit 2 ;;
  *) echo "PATCHED: version $VER not in affected list"; exit 0 ;;
esac

# Look for Jan 2022 CPU patch IDs in OPatch inventory
if command -v "$WL_HOME/OPatch/opatch" >/dev/null 2>&1; then
  PATCHES=$("$WL_HOME/OPatch/opatch" lsinventory 2>/dev/null | grep -E '33727616|33591019|33727640|33697227' )
  if [[ -n "$PATCHES" ]]; then
    echo "PATCHED: Jan 2022 CPU patch detected"
    echo "$PATCHES"
    exit 0
  fi
fi

echo "VULNERABLE: WebLogic $VER without Jan 2022 (or later) CPU patch applied"
exit 1

Sources

1. Tenable plugin 157127
2. Oracle January 2022 Critical Patch Update advisory
3. NVD — CVE-2022-21306
4. NVD — CVE-2022-21371
5. CISA KEV catalog
6. Y4er PoC — CVE-2022-21306
7. FIRST EPSS
8. Shodan WebLogic facet