{"id":"CVE-2017-3506","published":"2017-04-24T19:59:03Z","modified":"2026-06-17T01:18:26Z","title":"Oracle WebLogic Server OS Command Injection Vulnerability","vendor":"Oracle","product":"WebLogic Server","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an OS command injection vulnerability in the Web Services subcomponent of the Oracle WebLogic Server component of Oracle Fusion Middleware, affecting WebLogic Server releases 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. An unauthenticated attacker with network access over HTTP can exploit it, though the attack is difficult to carry out, to gain unauthorized creation, deletion or modification of critical data and unauthorized access to critical data or all data accessible to WebLogic Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:43Z"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95991,"percentile":0.99875,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2024-06-03","dueDate":"2024-06-24","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/cpuapr2017.html; https://nvd.nist.gov/vuln/detail/CVE-2017-3506","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-05-16","exploitedFirstSeen":"2023-05-16","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html","date":"2023-05-16"},{"url":"https://www.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities/","date":"2023-12-14"},{"url":"https://www.broadcom.com/support/security-center/protection-bulletin/unveiling-cryptocurrency-mining-tactic-of-the-8220-gang","date":"2024-05-30"},{"url":"https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html","date":"2024-05-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-06-03"},{"url":"https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html","date":"2024-06-28"},{"url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report--cyber-security-report-2025","date":"2025-02-09"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points","date":"2025-05-27"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2017-3506","date":"2025-06-07"}],"evidenceTotal":28,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/97884","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038296","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/97884","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038296","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated HTTP exploitation of public-facing WebLogic server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP","start":206,"end":301}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Grants read access to server-accessible data","mappingType":"primary_impact","evidence":[{"from":"description","quote":"unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data","start":524,"end":625}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-12627","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-12627","exploited":true,"exploitedSince":"2024-06-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2019-11-05","earliestUrl":"https://github.com/ianxtianxt/CVE-2017-3506","repos":[{"name":"Al1ex/CVE-2017-3506","url":"https://github.com/Al1ex/CVE-2017-3506","stars":9,"created":"2020-11-18"},{"name":"ianxtianxt/CVE-2017-3506","url":"https://github.com/ianxtianxt/CVE-2017-3506","stars":3,"created":"2019-11-05"}]},"nuclei":[{"id":"CVE-2017-3506","name":"Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution","severity":"high","path":"http/cves/2017/CVE-2017-3506.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3506.yaml"}],"first":{"date":"2019-11-05","source":"PoC-in-GitHub","url":"https://github.com/ianxtianxt/CVE-2017-3506"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2017-04-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3506","provenance":"source"},{"date":"2019-11-05","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ianxtianxt/CVE-2017-3506","provenance":"source"},{"date":"2023-05-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html","provenance":"source"},{"date":"2024-06-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-06-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-12627","provenance":"source"}],"speed":{"daysToPublicExploit":925,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2597},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1264 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9988"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.18,"detail":"base score 7.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}