New Zero-day flaw discovered in Oracle Web logic server let attackers exploit this vulnerability to remotely execute commands without authorization. An Oracle web Logic component wls9_async and wls-wsat trigger this deserialization remote command execution vulnerability and it affects all the Weblogic component wls9_async_response.war and wls-wsat.war enabled versions (including the current version).

Read full article on GBHackers