Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2017-10-19

CVE-2017-10271

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

  1. First PoC
  2. 2914 days →Metasploit
  3. 304 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-02-10 · due 2022-08-10 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

5 known · links only

Metasploit1

  1. Oracle WebLogic wls-wsat Component Deserialization RCE ↗

    The Oracle WebLogic WLS WSAT Component is vulnerable to a XML Deserialization remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Discovered by Alexey Tyurin of ERPScan and Federico Dotta of Media Service. Please note that SRVHOST, SRVPORT, HTTP_DELAY, URIPATH and related HTTP Server variables are only used when executing a check and will not be used when executing the e

    ruby · seen 2026-10-18

Exploit-DB3

  1. Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution ↗

    created 2017-12-26

  2. Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution ↗

    created 2018-01-03

  3. Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit) ↗

    created 2018-01-29

Nuclei1

  1. Oracle WebLogic Server - Remote Command Execution ↗

    The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.

    yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.