Skip to content
ProtocolPorts

Port reference

Port 7001 (TCP) – Oracle WebLogic Server

Default HTTP/T3 listen port for Oracle WebLogic Server administration and applications.

tcpRegistered

Quick facts

Transport
tcp
Category
Registered
Risk level
Critical

Actively exploited and high-impact — keep it off the public internet.

Default state

Open by default on WebLogic installs, serving the admin console and T3 protocol. Repeatedly affected by critical unauthenticated remote code execution flaws.

What is port 7001 used for?

Port 7001 is the default listening port for Oracle WebLogic Server, a Java EE application server used to host enterprise web applications. It serves the WebLogic administration console, deployed applications over HTTP, and Oracle's T3 remoting protocol that Java clients use to talk to the server. You will typically see it in large business and Oracle-stack environments rather than on personal machines.

When would you open it?

Open or forward 7001 only if you actually run WebLogic and need other machines to reach its console or hosted apps. In most setups it should stay on an internal management network, with a regular web server or load balancer handling public traffic instead.

Is it safe to open?

WebLogic has a long history of serious remote-code-execution flaws, so an exposed 7001 is a real risk; keep it off the public internet, patch promptly, and restrict it to trusted networks. See the security notes below.

How to check if this port is open

Linux
ss -tulpn | grep :7001
nmap -p 7001 <target>
Windows
netstat -ano | findstr :7001
Test-NetConnection <host> -Port 7001
macOS
lsof -i :7001
nmap -p 7001 <target>

How to open this port on your router

To reach this service from outside your network, forward the port on your router:

  1. Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
  2. Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
  3. Add a rule forwarding external port 7001 to your device's local IP, internal port 7001, protocol TCP.
  4. Save and reboot the router if prompted, then test the port from outside your network.

Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.

Allow this port through the firewall

Linux (ufw)
sudo ufw allow 7001/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --add-port=7001/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 7001 -j ACCEPT
Windows
New-NetFirewallRule -DisplayName "Allow 7001" -Direction Inbound -Protocol TCP -LocalPort 7001 -Action Allow

Security & risks

Common attacks

  • Unauthenticated deserialization RCE via T3/IIOP and the console
  • Exploitation of CVE-2017-10271, CVE-2019-2725, CVE-2020-14882
  • Mass scanning to deploy cryptominers and webshells
  • Admin console brute-force and authentication bypass

CVE-2017-10271CVE-2020-14882

Hardening

  • Apply Oracle Critical Patch Updates promptly — WebLogic is a frequent RCE target
  • Never expose 7001 to the internet; restrict to trusted management networks
  • Filter or disable the T3/IIOP protocols if not required
  • Front WebLogic with a WAF and block access to known-vulnerable URIs
  • Run with least privilege, strong console credentials, and active monitoring

How to block this port

Linux (ufw)
sudo ufw deny 7001/tcp
Linux (firewalld)
sudo firewall-cmd --permanent --remove-port=7001/tcp
sudo firewall-cmd --reload
Linux (iptables)
sudo iptables -A INPUT -p tcp --dport 7001 -j DROP
Windows
New-NetFirewallRule -DisplayName "Block 7001" -Direction Inbound -Protocol TCP -LocalPort 7001 -Action Block

nmap snippet

nmap -p7001 --script weblogic-t3-info,http-vuln-cve2017-10271 <target>

Replace <target> with the host or range you're authorized to scan.

Related ports

Port 7002Port 8080Port 443Port 1521

Frequently asked questions

Why is Oracle WebLogic on port 7001 attacked so often?
WebLogic has had a long series of critical unauthenticated deserialization flaws — CVE-2017-10271, CVE-2019-2725, CVE-2020-14882 and more — that allow remote code execution. Exposed 7001 instances are mass-scanned and exploited within hours of disclosure.
What protocols does port 7001 expose?
7001 serves WebLogic's HTTP admin console and applications, plus the T3 (and IIOP) remoting protocols. T3 deserialization has been the root of several critical RCEs, so filter or disable it where it isn't needed.

Related guides