Port 7001 – WebLogic Admin

TCP

Port 7001 is the Oracle WebLogic Server default HTTPS/T3S administration port. WebLogic serves its admin console, deployment APIs, and T3 protocol on port 7001. Exposed WebLogic instances have been targeted by critical deserialization vulnerabilities (CVE-2017-10271, CVE-2019-2725) enabling unauthenticated remote code execution.

Port Number

7001

Protocol

TCP

Service

Oracle WebLogic Server (SSL)

Range

IANA Registered (1024–49151)

Description

Oracle WebLogic Server uses port 7001 as the default SSL-enabled administration and application port. The admin console (http://host:7001/console), REST management API, and T3/T3S protocol for JNDI lookups and EJB calls all share this port. WebLogic on port 7001 has a history of severe deserialization vulnerabilities that enable unauthenticated remote code execution. Attackers scan for exposed WebLogic instances and exploit known CVEs within hours of disclosure. Mitigations: never expose port 7001 to the internet, restrict admin console access to management networks, apply Critical Patch Updates immediately, and use connection filters to whitelist allowed client IPs.

Security risks

1CVE-2017-10271 (CVSS 7.5): WebLogic WLS Security deserialization RCE via XMLDecoder – unauthenticated attacker sends crafted XML to /wls-wsat/CoordinatorPortType endpoint on port 7001, achieving remote code execution. Massively exploited for cryptocurrency mining from December 2017 onward. No authentication required.
2CVE-2019-2725 (CVSS 9.8): WebLogic zero-day RCE via deserialization in /_async/AsyncResponseService – bypassed the CVE-2017-10271 patch. Oracle released emergency out-of-band patch. Actively exploited within 24 hours of disclosure for Sodinokibi/REvil ransomware deployment.
3CVE-2020-14882 (CVSS 9.8): WebLogic console authentication bypass – unauthenticated attacker accesses admin console via specially crafted URL (/console/css/%252e%252e%252fconsole.portal). Combined with CVE-2020-14883 for full RCE. Exploited by multiple APT groups including China-nexus threat actors.
4T3/IIOP deserialization attacks: WebLogic's T3 protocol (port 7001) and IIOP protocol are persistent deserialization targets. Tools like ysoserial generate payloads that achieve RCE via T3 without any authentication. Block T3 protocol from external access via WebLogic connection filters.
5Admin console exposure: /console/ on port 7001 provides full application deployment, JNDI tree browsing, and server lifecycle control. Default credentials (weblogic/welcome1) are tested by every scanner. Brute-forcing the console is trivial without account lockout.

Firewall guidance

NEVER expose port 7001 to the internet – WebLogic has the highest density of critical RCE CVEs of any application server. Place behind a WAF that blocks T3/IIOP protocols and known exploit paths (/wls-wsat/, /_async/, /console/). Configure WebLogic connection filters to whitelist only management IPs. In production, disable the admin console on internet-facing managed servers and use a dedicated admin server on a management network.

Diagnosis commands

Detect WebLogic version via T3 protocol handshake

shell

nmap -p 7001 --script http-weblogic-t3-info target

Check if admin console is accessible (should return 404 or connection refused from internet)

shell

curl -sk https://host:7001/console/ -o /dev/null -w '%{http_code}'

Test if CVE-2017-10271 vulnerable endpoint is exposed (should be 404/blocked)

shell

curl -sk 'https://host:7001/wls-wsat/CoordinatorPortType' -o /dev/null -w '%{http_code}'

Test if CVE-2019-2725 vulnerable endpoint is exposed

shell

curl -sk 'https://host:7001/_async/AsyncResponseService' -o /dev/null -w '%{http_code}'

Usage examples

Port 7001 – WebLogic Admin

shell

curl -k https://host:7001/console/
nmap --script http-weblogic-t3-info -p 7001 target
wlst.sh: connect('admin','pass','t3s://host:7001')

Common services on this port

Oracle WebLogic ServerOracle Fusion MiddlewareOracle SOA SuiteOracle Service Bus

Related ports

7002

WebLogic managed server SSL

5556

WebLogic Node Manager

9001

WebLogic admin (alternate configs)

History

WebLogic was created by BEA Systems in 1997, acquired by Oracle in 2008. Port 7001 is the default since the earliest versions. WebLogic became notorious for deserialization vulnerabilities starting in 2015 (CVE-2015-4852). Between 2017-2023, Oracle patched 50+ critical WebLogic CVEs, many actively exploited for cryptomining and ransomware. Despite this, WebLogic remains widely deployed in financial services, government, and telecommunications due to Oracle enterprise licensing lock-in.

FAQ

How do I block T3 protocol attacks on port 7001?

In WebLogic Admin Console: Environment → Servers → your_server → Protocols → General: set 'External DNS Name' to block T3 from external. Better: use connection filters (Security → Filter → Connection Filter Rules) with rule: 'deny * * 7001 t3 t3s' for external IPs. Best: place a WAF/reverse proxy in front that only passes HTTP/HTTPS and blocks raw T3/IIOP socket connections entirely.

Is WebLogic safe if I patch regularly?

Oracle releases Critical Patch Updates quarterly. Between patches, zero-day exploitation windows exist (CVE-2019-2725 was exploited before the patch was available). Defense-in-depth: never expose port 7001 directly, use connection filters, disable unnecessary protocols (T3, IIOP), remove example applications, and run WebLogic with minimal OS privileges. Consider migration to Kubernetes-native platforms for new workloads.