{"id":"CVE-2017-10271","published":"2017-10-19T17:29:01Z","modified":"2026-08-13T05:17:13Z","title":"Oracle Corporation WebLogic Server Remote Code Execution Vulnerability","vendor":"Oracle","product":"WebLogic Server","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in the WLS Security subcomponent of the Oracle WebLogic Server component within Oracle Fusion Middleware, where missing authentication for critical functionality exists. An unauthenticated attacker with network access via the T3 protocol can easily exploit it, with no user interaction required, to take over the affected WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:20Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99994,"percentile":0.99987,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-10271","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-01-17","exploitedFirstSeen":"2017-01-17","ransomware":true,"evidence":[{"url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/","date":"2017-01-17"},{"url":"https://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve-2018-7600-in-a-worm-style-en/","date":"2018-04-20"},{"url":"https://isc.sans.edu/diary/Criminals+Dont+Read+Instructions+or+Use+Strong+Passwords/23850","date":"2018-07-09"},{"url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html","date":"2018-08-30"},{"url":"https://www.lacework.com/blog/elf-of-the-month-new-lucky-ransomware-sample/","date":"2019-01-08"},{"url":"https://www.alibabacloud.com/blog/threat-alert-multiple-cryptocurrency-miner-botnets-start-to-exploit-the-new-thinkphp-vulnerability_594369","date":"2019-01-13"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-","date":"2019-02-21"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-march-2019","date":"2019-04-09"},{"url":"https://www.fortinet.com/blog/threat-research/closer-look-satan-ransomwares-propagation-technics","date":"2019-05-20"},{"url":"https://cyware.com/news/satan-ransomware-an-overview-of-the-ransomwares-variants-and-exploits-35acecd3","date":"2019-06-15"}],"evidenceTotal":912,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/101304","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039608","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/c0mmand3rOpSec/CVE-2017-10271","tags":["Exploit"]},{"url":"https://www.exploit-db.com/exploits/43458/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43924/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/101304","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039608","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/c0mmand3rOpSec/CVE-2017-10271","tags":["Exploit"]},{"url":"https://www.exploit-db.com/exploits/43458/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/43924/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Unauthenticated network exploit against exposed WebLogic service","mappingType":"uncategorized","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via T3","start":204,"end":295}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Availability impact suggests service disruption","mappingType":"primary_impact","evidence":[{"from":"description","quote":"CVSS 3.0 Base Score 7.5 (Availability impacts)","start":425,"end":471}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-47d1c126a36d01f3bea4","title":"SpeakUp: A New Undetected Backdoor Linux Trojan","publisher":"research.checkpoint.com","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","date":"2019-02-04","mentions":[{"quote":"in the targeted servers:\na) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities\nb) CVE-2010-1871: JBoss Seam Framework remote code execution\nc) JBoss AS 3/4/5/6: Remote Command Execution (exploit)\nd) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization","start":6302,"end":6610},{"quote":"- Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271)","start":9968,"end":10047}]},{"id":"SRC-128e4deb77078a52c27d","title":"Rocke: The Champion of Monero Miners","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/rocke-champion-of-monero-miners/","date":"2018-08-30","mentions":[{"quote":"we first observed this actor exploiting vulnerabilities in Apache Struts, we've also observed what we believe to the same individual exploiting an Oracle WebLogic server vulnerability (CVE-2017-10271), and also exploiting CVE-2017-3066, a critical Java deserialization vulnerability in the Adobe ColdFusion","start":2737,"end":3043}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-1918","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1918","exploited":true,"exploitedSince":"2022-02-10","provenance":"source"},"exploits":[{"id":43392,"url":"https://www.exploit-db.com/exploits/43392","title":"Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution","type":"remote","platform":"multiple","date":"2017-12-26","verified":false,"provenance":"source"},{"id":43458,"url":"https://www.exploit-db.com/exploits/43458","title":"Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution","type":"remote","platform":"multiple","date":"2018-01-03","verified":true,"provenance":"source"},{"id":43924,"url":"https://www.exploit-db.com/exploits/43924","title":"Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2018-01-29","verified":true,"provenance":"source"},{"id":43924,"url":"https://www.exploit-db.com/exploits/43924","title":"Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2018-01-29","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2017-12-26"},"pocGithub":{"count":29,"skipped":1,"earliest":"2017-12-23","earliestUrl":"https://github.com/1337g/CVE-2017-10271","repos":[{"name":"shack2/javaserializetools","url":"https://github.com/shack2/javaserializetools","stars":516,"created":"2018-09-13"},{"name":"c0mmand3rOpSec/CVE-2017-10271","url":"https://github.com/c0mmand3rOpSec/CVE-2017-10271","stars":140,"created":"2017-12-28"},{"name":"kkirsche/CVE-2017-10271","url":"https://github.com/kkirsche/CVE-2017-10271","stars":128,"created":"2018-01-05"},{"name":"7kbstorm/WebLogic_CNVD_C2019_48814","url":"https://github.com/7kbstorm/WebLogic_CNVD_C2019_48814","stars":115,"created":"2019-04-25"},{"name":"SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961","url":"https://github.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961","stars":105,"created":"2019-04-25"}]},"metasploit":[{"name":"Oracle WebLogic wls-wsat Component Deserialization RCE","module":"exploit/multi/http/oracle_weblogic_wsat_deserialization_rce","type":"exploit","disclosureDate":"2017-10-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb"}],"nuclei":[{"id":"CVE-2017-10271","name":"Oracle WebLogic Server - Remote Command Execution","severity":"high","path":"http/cves/2017/CVE-2017-10271.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10271.yaml"}],"first":{"date":"2017-10-19","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb"},"provenance":"source"},"exploitRefs":["https://github.com/c0mmand3rOpSec/CVE-2017-10271","https://www.exploit-db.com/exploits/43458/","https://www.exploit-db.com/exploits/43924/"],"flow":[{"stage":"primary","techniques":["T1499.004"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-01-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/","provenance":"source"},{"date":"2017-10-19","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10271","provenance":"source"},{"date":"2017-10-19","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2017-12-23, Exploit-DB 2017-12-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb","provenance":"source"},{"date":"2018-08-30","kind":"report","label":"Named in blog.talosintelligence.com: Rocke: The Champion of Monero Miners","url":"https://blog.talosintelligence.com/rocke-champion-of-monero-miners/","provenance":"machine"},{"date":"2019-02-04","kind":"report","label":"Named in research.checkpoint.com: SpeakUp: A New Undetected Backdoor Linux Trojan","url":"https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-trojan/","provenance":"machine"},{"date":"2022-02-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-02-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1918","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1575},"priority":{"score":84.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3574 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 4 Exploit-DB entries; 29 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-oracle-weblogic-server-cwe-306"}}