iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Oracle issued an out-of-band Security Alert for CVE-2020-14750, a critical, unauthenticated remote code execution vulnerability in WebLogic Server. Oracle’s advisory was first released on November 1, 2020, and revised on November 6. It recommended applying the alert updates promptly. The alert is historical; it is not a newly disclosed 2026 vulnerability.
What Oracle’s out-of-band alert addressed
Oracle described CVE-2020-14750 as a remote code execution flaw in WebLogic Server related to CVE-2020-14882, which Oracle had addressed in its October 2020 Critical Patch Update. Oracle said CVE-2020-14750 could be exploited remotely without authentication, meaning an attacker did not need a username or password to exploit it over a network. Oracle’s Security Alert gives the official description.
Oracle’s risk matrix assigned CVSS 3.1 base score 9.8. It classified the attack vector as network, attack complexity as low, required privileges as none, and user interaction as none. The affected component was the WebLogic Server Console using HTTP. Oracle’s October 2020 Critical Patch Update covered CVE-2020-14882; the November alert addressed the related CVE-2020-14750.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat was reported about exploitation
SecurityWeek reported that attacks targeting CVE-2020-14882 had been observed the prior week, following the publication of proof-of-concept code. Its November 2, 2020 report also said exploit code for CVE-2020-14750 was available online. Those statements do not establish that CVE-2020-14750 itself was confirmed exploited in the reported attacks. The two CVEs should not be treated as interchangeable when describing the observed activity. SecurityWeek’s contemporaneous report covered both developments.
#1 Best Overall
WebLogic releases Oracle listed as affected
Oracle’s alert listed these five supported WebLogic Server releases as affected:
| Affected release | Oracle support and patch note |
|---|---|
| 10.3.6.0.0 | Alert patches are provided only for releases in Premier or Extended Support. |
| 12.1.3.0.0 | Alert patches are provided only for releases in Premier or Extended Support. |
| 12.2.1.3.0 | Alert patches are provided only for releases in Premier or Extended Support. |
| 12.2.1.4.0 | Alert patches are provided only for releases in Premier or Extended Support. |
| 14.1.1.0.0 | Alert patches are provided only for releases in Premier or Extended Support. |
These are the versions named in Oracle’s 2020 alert, not a statement about current support status. Oracle warned that alert patches were available only for versions in Premier or Extended Support and recommended upgrading unsupported versions. Consult Oracle’s advisory and support documentation to determine eligibility for a particular installation. Oracle’s affected-products table and support notice provide the release list and qualification.
How administrators should use the alert
- Identify the installed WebLogic Server release. Compare it with Oracle’s affected-version list above.
- Check support eligibility. Oracle limited Security Alert patches to releases in Premier or Extended Support; it recommended upgrading unsupported versions.
- Use Oracle’s version-specific patch guidance. The affected-products table links to the Fusion Middleware Patch Availability Document through My Oracle Support, where patch availability and installation instructions are provided. Follow that document for the applicable product release and environment rather than relying on generic installation steps.
- Check related Fusion Middleware components. Oracle notes that the alert should also be applied to database components of Fusion Middleware products as applicable. Use the patch-availability document to determine the requirements for the specific environment.
Oracle strongly recommended applying the Security Alert updates as soon as possible. Its advisory said this was due to the severity of the vulnerability and publication of exploit code on various sites. The alert’s remediation section directs administrators to Oracle’s support documentation for patch details.
What the public record does—and does not—establish
Oracle’s advisory credits 20 researchers or organizations for reporting the vulnerability. The cited public accounts establish the flaw’s severity, affected releases, patch direction, reported attacks against CVE-2020-14882, and online availability of exploit code for CVE-2020-14750. They do not establish a victim count, an attack count for CVE-2020-14750, or quantified losses.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
