CVE-2018-2893

ENISA EUVD: EUVD-2018-14748 ↗
✓ Confirmed 0-Day
Triaged: March 5, 2026 1 article Published: 2018-07-18
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗

EPSS Score

Source: FIRST.org · 2026-05-23
94.28%
probability
This CVE has a 94.28% probability of being exploited in the next 30 days.
0% Top 99.9th percentile of all CVEs 100%

CVSS v3.0

Source: NVD
9.8
CRITICAL
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2 (legacy)

7.5
HIGH
Access Vector
Network
Access Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

VulnerabilityLookup (CNA)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Products

Oracle Corporation
WebLogic Server
10.3.6.0 12.1.3.0 12.2.1.2 12.2.1.3

Exploits & PoC

pyn3rd/CVE-2018-2893

CVE-2018-2893-PoC

105 2018-10-27
qianl0ng/CVE-2018-2893

可以直接反弹shell

47 2023-04-05
bigsizeme/CVE-2018-2893

反弹shell生成器

17 2018-07-23
jas502n/CVE-2018-2893

CVE-2018-2893

13 2018-10-07
Draven996/CVE-2018-2893

CVE-2018-2893

0 2018-07-19
artofwar344/CVE-2018-2893

CVE-2018-2893 PoC

0 2018-07-19
ianxtianxt/CVE-2018-2893

CVE-2018-2893

0 2019-11-05
7 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
75%
EPSS 94.28%
CVSS v3.0 9.8
Mentions 1
Last Seen Jul 26, 2018

CNA Information

CNA Assigner
oracle

Analyst Note

CVE-2018-2893 is explicitly documented as exploited in the wild by CERT-EU in 2018, the same year of CVE publication and Oracle's patch release. The critical CVSS score (9.8), unauthenticated network exploitability, and contemporaneous wild exploitation strongly support zero-day classification, though specific timing details relative to patch availability are not fully documented.

Triage Info

Decided atMar 05, 2026
Published DateJul 18, 2018