Remote code execution flaw (CVE-2019-2729) impacts a number of versions of Oracle s WebLogic Server, used for building and deploying enterprise applications. The vulnerability has a CVSS score of 9.8 out of 10; it is remotely exploitable without authentication. Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible. The issue stems from a deserialization vulnerability in the XMLDecoder in the Web Logic Server web services. Researchers with KnownSec 404, who are credited (among others) for discovering the flaw, said they have seen the vulnerability being actively exploited in the wild.
Source: https://threatpost.com/oracle-warns-of-new-actively-exploited-weblogic-flaw/145829/