Skip to main content
protocols.pageprotocols.page
7002

Port 7002 – WebLogic Managed

TCP

Port 7002 is the default Oracle WebLogic managed server SSL port. While port 7001 hosts the admin server, managed servers in a WebLogic cluster typically use port 7002 for application traffic. Subject to the same deserialization vulnerabilities as port 7001 – restrict to internal networks and apply patches promptly.

Port Number

7002

Protocol

TCP

Service

Oracle WebLogic Managed Server

Range

IANA Registered (1024–49151)

Description

WebLogic managed servers on port 7002 serve deployed Java EE applications in a clustered configuration. The admin server on port 7001 coordinates the cluster, while managed servers on port 7002 (and sequential ports for additional instances) handle production application traffic. Managed servers on port 7002 expose the same attack surface as the admin server – T3 protocol listeners, IIOP endpoints, and any deployed application's servlets. The same deserialization exploits that target port 7001 work against port 7002. In production WebLogic deployments, front managed servers with a load balancer that only proxies specific application context roots, blocking direct access to WebLogic internal endpoints.

Security risks

  • 1Same deserialization attack surface as port 7001: CVE-2017-10271, CVE-2019-2725, and CVE-2020-14882 all apply to managed servers on port 7002. T3S (T3 over TLS) protocol on this port carries the same deserialization gadget chains – TLS encrypts the transport but does not prevent exploitation by an authorized network client.
  • 2Application-level vulnerabilities: deployed applications on managed servers (port 7002) inherit WebLogic's attack surface. JNDI injection via Log4Shell (CVE-2021-44228) targets lookup strings in application logs, chaining into WebLogic's JNDI context for RCE.
  • 3Cluster-wide propagation: compromising one managed server on port 7002 in a WebLogic cluster enables lateral movement via the admin channel. Session replication between cluster members means session hijacking on one node propagates to all.
  • 4TLS false sense of security: port 7002's TLS encryption protects data in transit but does not prevent exploitation. Attackers who can reach port 7002 (even through TLS) can still exploit T3S deserialization vulnerabilities identically to port 7001.

Firewall guidance

Port 7002 should only be accessible from: (1) the load balancer fronting the WebLogic cluster, (2) the admin server for management, (3) other managed servers for cluster communication. Block direct internet access entirely. The load balancer should proxy only specific application context roots (e.g., /app/) and block WebLogic internal paths (/wls-wsat/, /_async/, /console/, /bea_wls_internal/).

Diagnosis commands

Check TLS configuration on WebLogic managed server port

shell
openssl s_client -connect host:7002 -servername host </dev/null 2>&1 | grep -E '(Protocol|Cipher|subject)'

Test basic HTTPS connectivity to managed server

shell
curl -sk https://host:7002/ -o /dev/null -w '%{http_code}'

Audit TLS versions and cipher suites on WebLogic SSL port

shell
nmap -sV -p 7002 --script ssl-enum-ciphers target

Usage examples

Port 7002 – WebLogic Managed
shell
curl -k https://host:7002/app/
nmap -p 7002 --script ssl-enum-ciphers target
wlst.sh: connect('admin','pass','t3s://host:7002')

Common services on this port

Oracle WebLogic Managed ServerOracle Fusion ApplicationsOracle SOA SuiteOracle BPM Suite

Related ports

7001

WebLogic admin server (same vulnerabilities)

5556

WebLogic Node Manager

443

HTTPS (proxy in front of 7002)

History

Port 7002 has been the WebLogic managed server SSL port since WebLogic 8.x (early 2000s). In WebLogic's architecture, the admin server (7001) deploys and monitors applications on managed servers (7002+). Clustered deployments use sequential ports (7003, 7004, etc.) for additional managed servers. The separation was designed for operational clarity but provides no security isolation – all ports share the same vulnerable codebase.

FAQ

Can I secure port 7002 by just enabling TLS?

TLS protects against network sniffing but does NOT prevent exploitation. The T3S protocol (T3 over TLS) on port 7002 carries the same deserialization payloads as plain T3 on 7001. You need: WAF blocking exploit paths, connection filters restricting source IPs, disabled T3S from external networks, and current Critical Patch Updates. TLS is necessary but not sufficient.