{"cve":"CVE-2015-4852","nvd":{"published":"2015-11-18T15:59:00.133","modified":"2026-06-17T00:28:02.700","status":"Analyzed","description":"The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2015/11/17/19","http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"],"products":["oracle:storagetek_tape_analytics_sw_tool","oracle:virtual_desktop_infrastructure","oracle:weblogic_server"],"source":"nvd","synced_at":"2026-10-19T20:37:45.466985407+00:00"},"epss":{"cve":"CVE-2015-4852","score":0.94991,"percentile":0.99861,"date":"2026-10-31"},"kev":{"cve":"CVE-2015-4852","date_added":"2021-11-03","due_date":"2022-05-03","vendor":"Oracle","product":"WebLogic Server","known_ransomware":false},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}