CVE-2017-10271 KEVRansomwarePublic exploit High · 7.5 EPSS >99.9%

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

Oracle · WebLogic Server

Summary

The flaw is in the WLS Security subcomponent of the Oracle WebLogic Server component within Oracle Fusion Middleware, where missing authentication for critical functionality exists. An unauthenticated attacker with network access via the T3 protocol can easily exploit it, with no user interaction required, to take over the affected WebLogic Server.

Official description · NVD

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Breakdown

84.4 / 100

Exploited: Yes, in CISA KEV
Reports: 2
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

What they do
- Crash the applicationT1499.004 · Application or System ExploitationAI-written (claude-haiku-5-5)Medium confidence3 general detection rules
What can follow
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationSource dataMedium confidence149 general detection rules

First seen exploited 9 months before it was disclosed. Public exploit code (Metasploit) was available the same day.

First seen exploitedVulnCheck KEV evidence17 Jan 20179 mo before
DisclosedPublic exploit codeMetasploit19 Oct 2017day 0
First dated threat reportblog.talosintelligence.com30 Aug 2018+10 mo
Added to CISA KEVknown ransomware use; EU database agrees10 Feb 2022+4 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 11

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

MITRE CTID mapping of the CVE · uncategorised

ImpactTA0040

Application or System Exploitation T1499.004 Medium

AI mapping from the description · primary impact

Availability impact suggests service disruption

CVSS 3.0 Base Score 7.5 (Availability impacts)

From the official description (NVD) Original ↗

Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit

Detection

0 rules for this CVE · 152 general rules for its techniques

Rules for this CVE

0 that reference CVE-2017-10271 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Application or System ExploitationT1499.0043 general rules

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports

2 reportsCheck PointCisco TalosAug 2018 – Feb 2019

Reports are matched by finding the exact id CVE-2017-10271 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Check Point4 Feb 2019

SpeakUp: A New Undetected Backdoor Linux Trojan

…in the targeted servers: a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization…

Original (opens in a new tab) ↗

Cisco Talos30 Aug 2018

Rocke: The Champion of Monero Miners

…we first observed this actor exploiting vulnerabilities in Apache Struts, we've also observed what we believe to the same individual exploiting an Oracle WebLogic server vulnerability (CVE-2017-10271), and also exploiting CVE-2017-3066, a critical Java deserialization vulnerability in the Adobe ColdFusion…

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
44 more on OTX

References

7 links, grouped by NVD tag (6 duplicates merged)

Exploitation evidence

Exploited in the wild

Listed since 10 Feb 2022. Federal due date 10 Aug 2022. Known ransomware use.

Apply updates per vendor instructions.

ENISA

Marked exploited since 10 Feb 2022. EUVD-2017-1918

Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command ExecutionEDB-43392 · remote · multiple · 2017-12-26
Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command ExecutionEDB-43458 · remote · multiple · 2018-01-03 · verified
Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit)EDB-43924 · remote · multiple · 2018-01-29 · verified
Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit)EDB-43924 · remote · multiple · 2018-01-29 · verified

, 30 Oct 2026

>99.9%Top 0.01%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.99%).

3.1

7.5High · 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Priority factorsFormula

In a KEV cataloglisted in CISA KEV and VulnCheck KEV 35.0/35

Recent KEV listingadded 3574 days ago 0.0/10

Known ransomware useCISA KEV and VulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9999 20.0/20

Threat reports2 reports 6.1/10

Public exploit code3 NVD references tagged Exploit; 4 Exploit-DB entries; 29 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template 5.0/5

Mentioned in OTX pulses50 pulses 3.0/3

CVSS base scorebase score 7.5 5.3/7

End-of-life productsupported or unknown 0.0

Total84.4

Record

Published: 19 Oct 2017
Modified: 13 Aug 2026
: CWE-306 Missing Authentication for Critical Functionality
Elsewhere: NVD CVE.org KEV JSON

How an attack unfolds

1What they do

2What can follow

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

SpeakUp: A New Undetected Backdoor Linux Trojan

Rocke: The Champion of Monero Miners

Also mentioned in 50 community threat pulses (AlienVault OTX)

References

Vendor Advisory 1

US Government Resource 1

Third Party Advisory 4

Exploit 1

What they do

What can follow

techniques