CVE-2020-2555: Oracle Access Manager Auth Bypass Flaw

CVE-2020-2555 Overview

CVE-2020-2555 is a critical insecure deserialization vulnerability in the Oracle Coherence product of Oracle Fusion Middleware, specifically affecting the Caching, CacheStore, and Invocation components. This vulnerability allows an unauthenticated attacker with network access via the T3 protocol to achieve complete system compromise, including full takeover of affected Oracle Coherence instances. The vulnerability is easily exploitable and requires no user interaction, making it particularly dangerous for exposed enterprise environments.

Critical Impact

This vulnerability enables unauthenticated remote code execution leading to complete system takeover. It has been added to CISA's Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

Affected Products

• Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0
• Oracle Access Manager 11.1.2.3.0
• Oracle Commerce Platform versions 11.0.0, 11.1.0, and 11.2.0
• Oracle Communications Diameter Signaling Router
• Oracle Healthcare Data Repository 7.0.1
• Oracle Rapid Planning 12.1 and 12.2
• Oracle Retail Assortment Planning 15.0 and 16.0
• Oracle Utilities Framework versions 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, and 4.4.0.2.0
• Oracle WebCenter Portal 12.2.1.3.0 and 12.2.1.4.0

Discovery Timeline

• January 15, 2020 - CVE-2020-2555 published to NVD
• October 27, 2025 - Last updated in NVD database

Technical Details for CVE-2020-2555

Vulnerability Analysis

CVE-2020-2555 is classified as CWE-502 (Deserialization of Untrusted Data). The vulnerability exists within Oracle Coherence's handling of serialized Java objects received over the T3 protocol. Oracle Coherence is a distributed caching solution commonly deployed in enterprise environments to provide high availability and scalability for applications. The T3 protocol is Oracle's proprietary protocol used for communication between WebLogic Server components and clients.

The flaw allows attackers to craft malicious serialized objects that, when deserialized by the vulnerable Coherence component, execute arbitrary code on the target system. This type of deserialization attack leverages "gadget chains" - sequences of existing Java classes that can be chained together to achieve code execution during the deserialization process.

Root Cause

The root cause of CVE-2020-2555 lies in insufficient validation of serialized data within the Oracle Coherence caching framework. The affected components (Caching, CacheStore, Invocation) accept serialized Java objects over the network without adequately verifying the integrity or safety of the incoming data. Specifically, the vulnerability involves the com.tangosol.util.filter.LimitFilter and related classes that can be abused to construct exploitation chains leading to arbitrary method invocation.

Attack Vector

The attack is conducted over the network using the T3 protocol, which typically operates on port 7001 (the default WebLogic Server port). An attacker can exploit this vulnerability without any authentication credentials, making it accessible to any attacker who can reach the vulnerable service.

The exploitation flow involves:

1. The attacker establishes a T3 connection to the vulnerable Oracle Coherence instance
2. A specially crafted serialized Java object containing a malicious gadget chain is transmitted
3. The Coherence server deserializes the object, triggering the gadget chain execution
4. Arbitrary code executes with the privileges of the Oracle Coherence process

This vulnerability has been actively exploited in the wild and is tracked in CISA's Known Exploited Vulnerabilities Catalog. Multiple proof-of-concept exploits are publicly available, as documented in Packet Storm Oracle Coherence RCE, Packet Storm WebLogic Server RCE, and Packet Storm WebLogic Deserialization RCE.

Detection Methods for CVE-2020-2555

Indicators of Compromise

• Unusual outbound connections from Oracle WebLogic or Coherence server processes
• Unexpected child processes spawned by the WebLogic Server JVM (e.g., shells, scripting interpreters)
• Suspicious T3 protocol traffic containing serialized Java objects with known malicious class references such as com.tangosol.util.filter.LimitFilter
• Web shell files or unauthorized modifications to WebLogic deployment directories
• Evidence of post-exploitation activities such as credential harvesting or lateral movement originating from the application server

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with signatures for malicious T3 protocol payloads and known CVE-2020-2555 exploit patterns
• Monitor Java deserialization activity using endpoint detection and response (EDR) solutions capable of tracking JVM behavior
• Implement application-layer firewalls to inspect and filter T3 protocol traffic for suspicious serialized object patterns
• Configure logging for Oracle Coherence and WebLogic Server to capture detailed information about incoming connections and deserialization events

Monitoring Recommendations

• Enable comprehensive audit logging on Oracle WebLogic Server and Coherence instances
• Monitor network traffic on T3 protocol ports (default 7001) for anomalous patterns or connections from unexpected sources
• Establish baseline behavior for Oracle middleware processes and alert on deviations indicating potential compromise
• Correlate security events across multiple data sources including network flows, endpoint telemetry, and application logs

How to Mitigate CVE-2020-2555

Immediate Actions Required

• Apply the Oracle Critical Patch Update (CPU) that addresses CVE-2020-2555 immediately
• Restrict network access to T3 protocol ports (7001) using firewall rules to limit exposure to trusted networks only
• If patching is not immediately possible, consider taking vulnerable Coherence instances offline or isolating them from untrusted networks
• Conduct a security review to identify any systems that may have already been compromised
• Review CISA's Known Exploited Vulnerabilities Catalog entry for CVE-2020-2555 for additional guidance

Patch Information

Oracle has released patches addressing CVE-2020-2555 in multiple Critical Patch Updates. Organizations should apply the latest available patch from Oracle's security advisories:

• Oracle January 2020 CPU Advisory - Initial patch release
• Oracle July 2020 CPU Advisory - Additional fixes
• Oracle October 2020 CPU Advisory - Continued remediation
• Oracle January 2021 CPU Advisory - Further updates
• Oracle July 2021 CPU Advisory - Latest patches

Given the critical nature of this vulnerability and its active exploitation status, patching should be prioritized immediately.

Workarounds

• Implement network segmentation to isolate Oracle Coherence and WebLogic Server instances from untrusted networks
• Configure firewall rules to block T3 protocol access from external or untrusted sources; only allow connections from authorized application servers
• Disable the T3 protocol if not required for business operations, or enable T3 protocol filtering using WebLogic Server's connection filter mechanisms
• Consider using Oracle's Java serialization filters to block known dangerous classes used in exploitation gadget chains

# Example: Restrict T3 protocol access using WebLogic connection filter
# Add to weblogic.security.net.ConnectionFilterImpl configuration
# Deny T3 connections from all except trusted internal networks
weblogic.security.net.ConnectionFilter=weblogic.security.net.ConnectionFilterImpl
weblogic.security.net.ConnectionFilterRules=192.168.1.0/24 * * allow t3 t3s,* * * deny t3 t3s