CVE-2020-2555VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-2555: Oracle Multiple Products Remote Code Execution Vulnerability

Affects Oracle Multiple ProductsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 97.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-2555 (opens in a new tab)

Description

CVE-2020-2555 is a remote code execution vulnerability affecting multiple Oracle products. An unauthenticated attacker with network access via T3 or HTTP can exploit this flaw to take over the affected system. The impacted products include Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, and Oracle Communications Diameter Signaling Router (DSR). This vulnerability has been exploited in the wild.

Summary

Multiple Oracle products contain a remote code execution vulnerability (CVE-2020-2555) that allows an unauthenticated attacker with network access via T3 or HTTP protocols to execute arbitrary code and take control of the affected system. The affected products include Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, and Oracle Communications Diameter Signaling Router (DSR). This vulnerability is associated with CWE-502 (Deserialization of Untrusted Data). Exploitation has been observed in the wild.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on the affected system, leading to full system takeover. This poses a high risk to confidentiality, integrity, and availability of the impacted systems and data.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the high severity and active exploitation, organizations should monitor Oracle's official advisories for patches or workarounds and apply them promptly once available. Until then, restrict network access to affected services (T3 and HTTP) from untrusted sources where possible.

Weaknesses

CWE-502Deserialization of Untrusted Data (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:10:07 UTC

Weaknesses

References

Related threats