WaratekVRT Sign in

CVE-2017-10271 Oracle WebLogic Server

Affected softwareOracle WebLogic Server
Affected versions10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0
Severity7.5 High CVSS 3.1 3 scores
Fixed inOracle Critical Patch Update October 2017
WeaknessMissing authentication (CWE-306)
Published19 Oct 2017
Updated13 Nov 2026

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-02-10 · remediation due 2022-08-10 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 43 citations · honeypot sightings · 28 exploits · earliest 2017-01-17.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 35 indexed Published artifacts you can open, in Exploit-DB, GitHub PoC, Metasploit, Nuclei; first seen 2017-12-23.
  • EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-10271 in VulnCheck (free account), which lists 38 more citations and 23 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 880 days 2023-11-16 to 2026-11-12
Reported exploitation unit42.paloaltonetworks.com /malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products 2017-01-17
Reported exploitation blog.netlab.360.com /botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style-en 2018-04-20
Reported exploitation isc.sans.edu /diary/Criminals+Dont+Read+Instructions+or+Use+Strong+Passwords/23850 2018-07-09
Reported exploitation blog.talosintelligence.com /2018/08/rocke-champion-of-monero-miners.html 2018-08-30
Reported exploitation lacework.com /blog/elf-of-the-month-new-lucky-ransomware-sample 2019-01-08
Exploit reference VulnCheck XDB d4ef87756956 Exploit type: initial-access 2017-12-23
Exploit reference VulnCheck XDB 227b6343c39a Exploit type: initial-access 2017-12-28
Exploit reference VulnCheck XDB ceea1ee6f89d Exploit type: initial-access 2017-12-28
Exploit reference VulnCheck XDB 5876caaffa74 Exploit type: initial-access 2018-01-03
Exploit reference VulnCheck XDB d09b1e7f97cc Exploit type: initial-access 2018-01-05
IndexArtifactStarsFirst seen
GitHub PoC Java反序列化漏洞利用工具V1.0 Java反序列化相关漏洞的检查工具，采用JDK 1.8+NetBeans8.2开发，软件运行必须安装JDK 1.8或者以上版本。 支持：weblogic xml反序列化漏洞 CVE-2017-10271/CNVD-C-2019-48814/CVE-2019-2725检查。 517 2018-09-13
Nuclei Oracle WebLogic Server - Remote Command Execution
Exploit-DB Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit) 2018-01-29
Metasploit Oracle WebLogic wls-wsat Component Deserialization RCE (excellent rank)
GitHub PoC WebLogic Exploit 140 2017-12-28
Exploit-DB Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit) 2018-01-29
GitHub PoC Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271) 128 2018-01-05
Exploit-DB Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution 2018-01-03
GitHub PoC WebLogic CNVD-C-2019_48814 CVE-2017-10271 Scan By 7kbstorm 115 2019-04-25
Exploit-DB Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution 2017-12-26

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Protected by Waratek.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

ARMR Marshal ARMR Process, Marshal RCE rule

How to mitigate CVE-2017-10271

Apply the fix in Oracle Critical Patch Update October 2017. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H NVD Primary published
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CISA-ADP Secondary
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:N/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update October 2017 ↗ CPU 2017-Q4 Oracle Fusion Middleware / WLS Security (10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Fusion Middleware WLS Security 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.1.0 · 12.2.1.2.0

Products and versions

1 product, 4 version entries
SourceVendorProductSchemeAffected versions
nvd oracle weblogic server generic 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.1.0 · 12.2.1.2.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** T3, NO AUTH REMOTE EXPLOIT, WLS SECURITY **Products:** ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE

References

URLTags
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch, Vendor Advisory
http://www.securityfocus.com/bid/101304 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039608 Broken Link, Third Party Advisory, VDB Entry
https://github.com/c0mmand3rOpSec/CVE-2017-10271 Exploit
https://www.exploit-db.com/exploits/43458/ Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/43924/ Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271 US Government Resource

Timeline
VulnCheck KEV: earliest evidence2017-01-17Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Published2017-10-19By the CVE Program.
Added to CISA KEV2022-02-10Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-08-13NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-12Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.