Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2019-2725

oracleagile product lifecycle management

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

VTP deterministic threat50.0of 100 · CVSS excluded

VTP analyst assessment

Oracle WebLogic HTTP injection

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence90%
Public exploitation · VTP factKEV

Assessment

CISA KEV lists this Oracle WebLogic vulnerability as known exploited. An unauthenticated HTTP attacker can compromise affected WebLogic Server installations.

Why it matters

  • Successful exploitation can result in takeover of the affected WebLogic Server.

Evidence

1 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.

Next watchpoint

If you use WebLogic 10.3.6.0.0 or 12.1.3.0.0, apply Oracle remediation and restrict HTTP exposure.

AI baseline history (4)
  1. BASELINE ASSESSED
    Oracle WebLogic HTTP injectiongpt-5.6-terra · low
  2. BASELINE ASSESSED
    Oracle WebLogic HTTP injectiongpt-5.6-terra · low
  3. BASELINE ASSESSED
    Oracle WebLogic injectiongpt-5.6-terra · low
  4. BASELINE ASSESSED
    Oracle WebLogic Server injection and takeovergpt-5.6-sol · high
Technical severityCRITICALCVSS 9.8 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityNONE KNOWNReliability not implied
EPSS1.00100th percentile · prediction
Evidence confidence0%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
LOW

The request shares exploitation-associated characteristics with CVE-2019-2725, but the evidence does not identify one CVE with sufficient confidence.

CANDIDATE LEADTechnical consistency 80/100

Basis: deterministic technical candidate

CVE-2019-2725
Potentially consistent; exploitation not confirmedDisclosure embargo completed
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    EPSS is 1.00; this is predictive context, not exploitation evidence.

  3. 03

    First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.

02

Material change ledger

What changed

KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

0publications detected
0underlying evidence chains

0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

04

Event history

Threat timeline

  1. 00:0010 Jan
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

05

Original publications

Source record

06

Technical vulnerability data

Context, not threat proof

VTP threat score50.0vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction20 / 20
Exploit availability0 / 15
Source independence0 / 15
Intelligence recency0 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-74
CPE records
16
Deterministic history records
20
Primary technical reference
07

Raw observations

First-party sensor records

First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.