CVE-2015-4852

What it actually does

Remote code execution via unsafe deserialization of attacker-supplied Java objects over the T3 protocol, triggered by vulnerable commons-collections gadget chains.

Why it matters to the business

Complete server takeover enabling data theft, persistence, lateral movement, and disruptive attacks; high urgency from CISA KEV listing with a 2022 remediation deadline and sustained high exploitation probability.

How an attack unfolds

An attacker sends a crafted serialized Java object containing malicious commons-collections gadget chains over T3 protocol to TCP port 7001; the server deserializes the object and executes attacker-controlled commands without authentication.

How to fix it

Upgrade Oracle WebLogic Server to patched releases that remove the vulnerable commons-collections classes or disable unsafe T3 deserialization; apply all available Oracle Critical Patch Updates.

How to confirm the fix worked

Verify server version against Oracle advisory, confirm T3 port is restricted or patched, and test that crafted serialized objects are rejected.

Typical attack path

1. Scan for Oracle WebLogic instances listening on TCP port 7001
2. Craft malicious serialized object using known commons-collections deserialization gadgets
3. Transmit object via unauthenticated T3 protocol request
4. Trigger deserialization to achieve remote code execution and establish foothold

How to detect it

Inspect network logs and firewall records for unexpected T3 connections to port 7001, review application logs for deserialization errors or unusual object streams, and search for post-exploitation artifacts such as new processes or files created after T3 traffic.

• T3 protocol traffic containing serialized Java objects to port 7001
• com.bea.core.apache.commons.collections
• java.io.ObjectInputStream
• Unexpected child processes launched by WebLogic after inbound T3 connections

What your security team should do

• Apply patches or upgrades immediately given KEV status and active exploitation
• Restrict T3 protocol access to trusted networks only
• Enable network segmentation and monitoring for port 7001 traffic
• Audit and remove unnecessary commons-collections dependencies