CVE-2017-3506 Oracle WebLogic Server
| Affected software | Oracle WebLogic Server |
|---|---|
| Affected versions | 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.2.1.2 |
| Severity | 7.4 High CVSS 3.1 3 scores |
| Fixed in | Oracle Critical Patch Update April 2017 |
| Weakness | OS command injection (CWE-78) |
| Published | 24 Apr 2017 |
| Updated | 13 Nov 2026 |
Description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2024-06-03 · remediation due 2024-06-24 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 11 citations · honeypot sightings · 1 exploit · earliest 2023-05-16.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
- Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2019-11-05.
- EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2017-3506 in VulnCheck (free account), which lists 6 more citations not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 28 days | 2026-09-22 to 2026-11-12 |
| Reported exploitation | trendmicro.com | /en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html | 2023-05-16 |
| Reported exploitation | imperva.com | /blog/imperva-detects-undocumented-8220-gang-activities | 2023-12-14 |
| Reported exploitation | broadcom.com | /support/security-center/protection-bulletin/unveiling-cryptocurrency-mining-tactic-of-the-8220-gang | 2024-05-30 |
| Reported exploitation | trendmicro.com | /en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html | 2024-05-30 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2024-06-03 |
| Exploit reference | VulnCheck XDB 7f8c560d1204 | Exploit type: initial-access | 2023-12-21 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2017-3506 | 9 | 2020-11-18 |
| GitHub PoC | CVE-2017-3506 | 3 | 2019-11-05 |
| Nuclei | Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher set this CVE's status to Protected by Waratek. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Looks like a process forking: https://hackerone.com/reports/810778
H2 Historical Data
Labels: HTTP, WEB SERVICES, NO AUTH REMOTE EXPLOIT
Products: ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE
How to mitigate CVE-2017-3506
Apply the fix in Oracle Critical Patch Update April 2017. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
7.4 HIGH
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
3 metrics
CVSS
7.4 HIGH v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
NVD | Primary | published |
| CVSS 3.1 | 7.4 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
CISA-ADP | Secondary | |
| CVSS 2.0 | 5.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2017 ↗ | CPU | 2017-Q2 | Oracle Fusion Middleware / Web Services (10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.2.1.2) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Fusion Middleware | Web Services | 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.2.1.2 | 10.3.6.0 · 12.1.3.0 · 12.2.1.0 · 12.2.1.1 · 12.2.1.2 |
Products and versions
1 product, 5 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.0.0 · 12.2.1.1.0 · 12.2.1.2.0 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, WEB SERVICES, NO AUTH REMOTE EXPLOIT **Products:** ORACLE WEBLOGIC SERVER, ORACLE FUSION MIDDLEWARE
References
| URL | Tags |
|---|---|
| https://www.oracle.com/security-alerts/cpuapr2017.html | |
| http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html | Patch, Vendor Advisory |
| http://www.securityfocus.com/bid/97884 | Broken Link, Third Party Advisory, VDB Entry |
| http://www.securitytracker.com/id/1038296 | Broken Link, Third Party Advisory, VDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506 | US Government Resource |
Timeline
Timeline
| Published | 2017-04-24 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2023-05-16 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2024-06-03 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |