Ok, Let's get to the point: vulnerability CVE-2015-4852 is not about the T3 protocol. The problem lies in the serialization/deserialization routines used by WebLogic and the underlying libraries that compose the java classpath.
So, just to make a few points clear:
- The T3 protocol is cited because it is a point of entrance to
user-provided serialized data.
- WebLogic is cited because it comes bundled with the affected Apache Commons
library and it is loaded in the classpath when WebLogic is run. It needs to be updated so that the affected bundled library can be updated too. Or you could update it yourself.
- The real problem lies within the Apache Commons library itself.
Therefore answering to your question, yes, your application still might be affected by deserialization vulnerabilities if the attacker is able to find somewhere else to enter serialized malicious data. Some Java applications rely heavily in serialization. Lots of them also send it through HTTP/S connections being base64-encoded or with some other type of encoding. Java JSP applications also make use of Viewstates (base64'd too, although it uses a structure that differs from ASP.NET Viewstates).
I've even seen Oracle's HCM (Human Capital Management) module use base64-encoded serialization to define a page title (yes, i was able to change it to whatever i wanted, but by the time a examined it, i wasn't much aware of the inner workings of deserialization flaws)
There has been some development on this issue. Not in this CVE itself, but some folks found out that there are more libraries (very common ones also) that are vulnerable to the whole serialization/deserialization matter.