CVE-2018-2628

What is Oracle WebLogic Server?

Oracle WebLogic Server is a widely deployed Java EE application server used to run enterprise business applications — everything from internal line-of-business systems to customer-facing portals — at large organizations, government agencies, and service providers worldwide. Its scale of deployment, combined with the fact that many installations run as privileged services with significant CPU resources, makes it a long-running favorite target for both nation-state actors and financially motivated attackers, especially cryptomining operations looking for powerful, poorly monitored servers.

Overview

CVE-2018-2628 is a critical, unauthenticated remote code execution vulnerability in WebLogic Server reachable via its T3 protocol, which WebLogic uses for RMI (Remote Method Invocation) communication between clustered servers and clients. An attacker with only network access to the T3 listener — no credentials required — can send a malicious serialized Java object that, when deserialized by the server, triggers arbitrary code execution.

Technical Details

The vulnerability is a Java deserialization flaw (CWE-502): WebLogic's T3 protocol handler deserializes objects from incoming network traffic without adequately restricting which classes can be instantiated during that process. By crafting a serialized object payload that leverages "gadget chains" available on the server's classpath (a technique widely popularized around this era via libraries like Apache Commons Collections), an attacker can cause arbitrary code to run as a side effect of the deserialization process itself — before any application-level authentication check is ever reached. A single network request against the T3 port is sufficient; no user interaction or prior access is needed.

Discovery

The vulnerability was fixed by Oracle as part of its April 2018 Critical Patch Update. Within days of the patch's release, independent researchers reverse-engineered the fix and published working proof-of-concept exploit code, which is common for WebLogic deserialization bugs and dramatically accelerated real-world exploitation.

Exploitation Context

CVE-2018-2628 was one of the most heavily and rapidly weaponized WebLogic vulnerabilities of its era. Once public PoC exploit code circulated, opportunistic scanning and exploitation began almost immediately, with cryptomining campaigns (including activity associated with groups tracked under names such as the "8220 Gang," known for chaining multiple WebLogic and other Java deserialization vulnerabilities) using it to deploy Monero-mining malware at scale on compromised WebLogic servers, alongside worm-like self-propagating exploitation attempts. CISA's KEV listing, added in 2022, reflects that unpatched WebLogic servers remain targeted for this vulnerability years after the original patch.

Remediation

1. Apply Oracle's April 2018 Critical Patch Update (or a later cumulative CPU) to all WebLogic Server deployments — this vulnerability has been patched for years, so any exposure at this point reflects a severe patch-management gap.
2. Restrict or firewall the WebLogic T3 protocol port from any untrusted network, since exploitation occurs directly over this protocol.
3. Where feasible, disable the T3 protocol entirely on servers that don't require it for clustering or RMI communication.
4. Monitor WebLogic servers for unexpected CPU spikes, unfamiliar processes, or outbound connections to mining pools — classic indicators of cryptomining payloads delivered via this vulnerability.
5. Review WebLogic access logs for anomalous T3 traffic patterns consistent with deserialization exploit attempts, and treat any internet-facing WebLogic instance as high priority for immediate patching.