Port 7443 – WebLogic SSL (Secure WebLogic Server)

Port 7443 is a common SSL/HTTPS listener for Oracle WebLogic Server — the TLS-wrapped counterpart to WebLogic’s cleartext admin listener on port 7001. Over 7443, WebLogic serves the browser-based administration console and application traffic over HTTPS, along with T3S, the TLS-wrapped version of WebLogic’s proprietary T3 remote protocol. The port is also the IANA-registered oracleas-https service used by Oracle Application Server and Fusion Middleware for secure web access. One honest caveat up front: WebLogic’s out-of-the-box default SSL port is actually 7002, but 7443 is very widely configured as the HTTPS/console port across Oracle middleware deployments — and, beyond Oracle, 7443 is a generic alternate-HTTPS port that all kinds of firewalls, control panels, and appliances answer on. So an open 7443 is usually WebLogic or Oracle-middleware SSL, but the first job is always to identify the product behind the certificate.

Why It’s Open

WebLogic underpins a large share of enterprise middleware, so wherever an admin or managed server terminates TLS, an HTTPS/T3S listener sits beside the cleartext one on 7001. Administrators point 7443 at the console and application endpoints when they want encrypted management, and Oracle Fusion Middleware stacks (SOA Suite, WebCenter, Oracle HTTP Server web tiers) frequently place their SSL virtual hosts here. Because it’s just “HTTPS on a high port,” 7443 is also a catch-all alternate to standard HTTPS on port 443 and its close sibling 8443 — you’ll see it on network appliances, admin panels, and IoT devices that need a second TLS endpoint separate from the main site. That ambiguity is the whole point of enumerating it: an open 7443 tells you a TLS service is listening, not which one, so the certificate and HTTP responses are what pin down whether you’re looking at WebLogic, an Oracle web tier, or an unrelated appliance.

Common Risks

• The full WebLogic RCE surface rides the HTTPS/T3S side too. TLS encrypts the channel, it doesn’t remove the bug class. The console path-traversal chain and T3/IIOP deserialization flaws that make port 7001 one of the most-exploited enterprise services reach the same handlers when the console and T3S are served over 7443 — a self-signed cert on the listener does nothing to stop them. T3S is RMI under the hood, the same Java-serialization model behind the Java RMI registry on port 1099, so it’s the same class of gadget-chain RCE, just TLS-wrapped. See 7001 for the full deserialization and console-bypass playbook; all of it applies here over an encrypted socket.
• Weak or misconfigured TLS. Deprecated protocols (SSLv3, TLS 1.0/1.1), RC4 or export ciphers, and unpatched TLS stacks expose the listener to downgrade and decryption attacks — the 7443-specific risk that has nothing to do with WebLogic itself.
• Certificate weaknesses. Self-signed, expired, or wrong-hostname certificates mean clients that skip validation can be man-in-the-middled, and the cert’s subject/SAN often leaks internal hostnames and the product name.
• Default or weak console credentials. A weblogic / default admin login over the HTTPS console is immediate takeover — deploy a malicious WAR and you own the host, exactly as on 7001.
• Internet-facing management plane. WebLogic’s admin surface was never meant to face the internet. Exposed WebLogic (7001 and 7443 alike) is a first-tier ransomware and cryptomining target, weaponized within days of each Oracle Critical Patch Update.
• Misidentification. Assuming 7443 is WebLogic when it’s another appliance (or vice versa) wastes effort and misses real findings — always confirm the product first.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and version

nmap -sV -p 7443 <target>

Read the certificate and grade the TLS config

openssl s_client -connect <target>:7443
nmap -p 7443 --script ssl-cert,ssl-enum-ciphers <target>
sslscan <target>:7443

The certificate is the fastest way to identify what’s really listening: the subject/issuer, SAN hostnames, and OU frequently name the product (WebLogic, an Oracle web tier, or a specific appliance). ssl-enum-ciphers grades every protocol and cipher the listener accepts and flags weak SSLv3/TLS 1.0/RC4 support.

Probe the WebLogic console over HTTPS

curl -kI https://<target>:7443/console
curl -sk https://<target>:7443/console/login/LoginForm.jsp | grep -i weblogic

A /console login page (or a redirect to it) confirms WebLogic and puts the console-bypass CVEs below in scope. -k accepts the untrusted cert so you can reach the app.

Check for T3S (secure T3)

nmap -sV -p 7443 --script weblogic-t3-info <target>

weblogic-t3-info performs a plaintext T3 handshake and returns the exact build; note that it does not speak T3S, so a null result on the SSL listener doesn’t rule out WebLogic — fall back to the certificate and the /console probe. Once you’ve confirmed the version, map it straight to the Oracle Critical Patch Update CVEs (see 7001).

Log every open 7443, the certificate details, the identified product, and the exact WebLogic build so the evidence flows straight into the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

WebLogic vulnerabilities are best treated as a recurring family tied to Oracle’s quarterly Critical Patch Updates — and the console and T3 flaws below reach the same handlers whether they’re served over cleartext on 7001 or over TLS on 7443. The 7443-specific risk on top of them is the TLS configuration itself (weak ciphers, untrusted certs). The entries below are NVD-verified; see port 7001 for the complete WebLogic RCE list.

• CVE-2020-14882 + CVE-2020-14883 — Administration Console path traversal. 14882 (CVSS 9.8 Critical) lets an unauthenticated attacker reach a privileged console handler via a crafted /console/... URL; chained with 14883 (7.2 High) it becomes full unauthenticated RCE in a single request — and it works identically against the console when it’s exposed over HTTPS on 7443. Mass-exploited within a week of the October 2020 CPU. CISA KEV. Metasploit exploit/multi/http/weblogic_admin_handle_rce.
• CVE-2020-14750 — Oracle’s out-of-band patch after the original 14882 fix was bypassed. Same Administration Console RCE, unauthenticated over HTTP/HTTPS, CVSS 9.8 Critical. Affects 10.3.6, 12.1.3, 12.2.1.3, 12.2.1.4, 14.1.1. CISA KEV — a reminder to patch the console flaw fully, not just the first advisory.
• CVE-2023-21839 — WLS Core, unauthenticated access over T3 and IIOP (and their TLS-wrapped T3S/IIOP-over-SSL variants). NVD scores it 7.5 (High) for data access, but it’s exploited as RCE via a remote JNDI (ForeignOpaqueReference) lookup to a rogue LDAP/RMI server. Affects 12.2.1.3, 12.2.1.4, 14.1.1. CISA KEV.

Mitigation

• Never expose WebLogic to the internet. Keep 7443, 7001, /console, and the T3/T3S/IIOP listeners off the public internet — front them with a firewall or reverse proxy and restrict to a management range. Exposure is the root cause behind nearly every WebLogic mass-exploitation event.
• Apply Oracle Critical Patch Updates promptly. WebLogic RCE is a quarterly treadmill and the gap between patch and mass exploitation is often days. TLS on 7443 does not mitigate any of the deserialization or console bugs — only patching does.
• Use a valid CA-issued certificate and strong TLS. Enforce TLS 1.2/1.3 with modern ciphers, disable SSLv3/TLS 1.0/1.1/RC4, and never rely on self-signed or expired certs; confirm with ssl-enum-ciphers or testssl.sh.
• Filter T3/T3S and lock down the console. Configure a weblogic.security.net.ConnectionFilterImpl to allow T3/T3S only from trusted hosts, disable IIOP and T3 if unused, restrict the console to a VPN/management network, and remove or rename default accounts.
• Front with a WAF and monitor. A WAF blocks known console-traversal payloads even over HTTPS; alert on encoded /console paths, T3 handshakes, and unusual access to 7443.
• Identify before you trust. If 7443 is not WebLogic, harden whatever appliance actually owns it — patch it, replace its cert, and restrict access the same way. See port 7001 for the full WebLogic hardening checklist.

Real-World Example

A recurring pattern with 7443 is “HTTPS as a false sense of security.” A team exposes the WebLogic administration console to a partner network or the internet over 7443, reasoning that because the listener is TLS-encrypted the console is safe. But the October 2020 console path-traversal chain (CVE-2020-14882/-14883, followed by the CVE-2020-14750 bypass patch) turns a single crafted /console/... request into unauthenticated remote code execution — and that request works exactly the same whether it hits the cleartext listener on 7001 or the HTTPS listener on 7443. The self-signed certificate the team put on the port encrypts the exploit in transit; it does nothing to stop it. Within about a week of the CPU, attackers were spraying the payload across the internet against unpatched builds. The lesson is the one that repeats across every WebLogic incident: TLS protects the channel, not the application — an internet-reachable WebLogic console plus an unapplied Critical Patch Update equals full compromise, port 7443 included.

FAQ

What is port 7443 used for?

Port 7443 is a widely used SSL/HTTPS listener — most often for Oracle WebLogic Server and Oracle Fusion Middleware (it’s the IANA-registered oracleas-https service), where it carries the administration console and applications over HTTPS plus WebLogic’s T3S secure remote protocol. It’s also a generic alternate-HTTPS port used by firewalls, control panels, and appliances, so the exact service depends on the host.

Is port 7443 the same as port 7001, and what about 7002?

They’re related listeners for the same server. Port 7001 is WebLogic’s default cleartext port (console + T3/IIOP). WebLogic’s out-of-the-box default SSL port is 7002, but 7443 is very commonly configured as the HTTPS/console port in Oracle middleware deployments — it’s the encrypted counterpart, carrying the same console and a TLS-wrapped T3S. The vulnerabilities are shared; 7443 just adds a TLS layer to test.

Is port 7443 dangerous?

On an untrusted network, yes, when it’s WebLogic. The console auth-bypass and T3/IIOP deserialization flaws that make WebLogic a top ransomware target are reachable over the HTTPS/T3S side on 7443 too — TLS encrypts them, it doesn’t stop them. On non-WebLogic appliances the risk depends on the product, which is why identifying the service behind the certificate is step one.

How do I secure or close port 7443?

If it’s WebLogic: keep it and /console off the public internet, apply Oracle Critical Patch Updates on release, filter T3/T3S to trusted hosts, use a valid CA cert with TLS 1.2/1.3, remove default console accounts, and put a WAF in front. If it’s another appliance, patch it and replace weak certs. If nothing needs the port, disable the listener and confirm with a rescan.

TL;DR

• Service: WebLogic SSL — the HTTPS/T3S counterpart to WebLogic on 7001; also oracleas-https and a generic alt-HTTPS port
• Default port: 7443/TCP (note: WebLogic’s built-in default SSL port is 7002; 7443 is the commonly-configured HTTPS/console port and a broader alternate-HTTPS port)
• Biggest risk: the full WebLogic console-bypass and T3/IIOP deserialization RCE surface reachable over TLS, plus weak-cipher/untrusted-cert issues on the listener
• Mitigation: never expose WebLogic//console to the internet, apply Oracle CPUs promptly, filter T3/T3S, use a valid cert with strong TLS, and identify the product before trusting the port — see 7001 for full WebLogic hardening