CVE-2017-10271

Confirmed PUBLISHED

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are...

Oracle Corporation · WebLogic Server

Exploited in the wild Active exploitation observed Used in malware PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

116

Unique Attacker IPs

CISA KEV

In CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

7.5 High EPSS 100.0%

At a Glance

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

malware cisa metasploit nuclei_scanner ransomware

CVE Published: Oct 19, 2017
Exploitation Reported: Feb 10, 2022
CVSS: 7.5 High
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Oracle Corporation	WebLogic Server	10.3.6.0.0	Affected
Oracle Corporation	WebLogic Server	12.1.3.0.0	Affected
Oracle Corporation	WebLogic Server	12.2.1.1.0	Affected
Oracle Corporation	WebLogic Server	12.2.1.2.0	Affected

CVE References

43458 exploit-db.com · Exploit https://www.exploit-db.com/exploits/43458/
43924 exploit-db.com · Exploit https://www.exploit-db.com/exploits/43924/
1039608 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1039608
101304 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/101304
GitHub — c0mmand3rOpSec/CVE-2017-10271 github.com · CVE Record https://github.com/c0mmand3rOpSec/CVE-2017-10271

Show 1 more reference

oracle.com/technetwork/security-advisory/cpuoct2017-323... oracle.com · CVE Record http://www.oracle.com/technetwork/security-advisory/cpuoct2017-323662...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2022-02-10 00:00 UTC
The Shadowserver	2026-05-30 00:00 UTC
KEVIntel	2026-06-24 16:09 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 2
Distinct User-Agents: 66

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10271.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 5.0 Medium

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitation Status

Exploited in the wild

Recorded 2022-02-10 00:00:00 UTC · CISA

Active exploitation observed

Recorded 2026-06-12 00:32:30 UTC · KEVIntel sensor

Used in malware

Recorded 2022-02-10 00:00:00 UTC · CISA

Proof of concept available

Recorded 2017-12-23 13:04:23 UTC · GitHub

Weaknesses (CWE)

CWE-306

Missing Authentication for Critical Function

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10271.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Al1ex/CVE-2017-10271

github · Created 2020-11-18 02:31:18 UTC · 2 stars

CVE-2017-10271

testwc/CVE-2017-10271

github · Created 2020-04-06 02:01:20 UTC · 0 stars

CVE-2017-10271

ianxtianxt/-CVE-2017-10271-

github · Created 2019-11-05 13:33:56 UTC · 2 stars

(CVE-2017-10271)Java反序列化漏洞

XHSecurity/Oracle-WebLogic-CVE-2017-10271

github · Created 2019-03-15 01:50:01 UTC · 1 stars

原创作者：Bearcat@secfree.com

r4b3rt/CVE-2017-10271

github · Created 2018-12-20 03:17:51 UTC · 0 stars

Weblogic(CVE-2017-10271)

lonehand/Oracle-WebLogic-CVE-2017-10271-master

github · Created 2018-07-06 08:32:28 UTC · 1 stars

peterpeter228/Oracle-WebLogic-CVE-2017-10271

github · Created 2018-01-19 15:50:08 UTC · 0 stars

WebLogic wls-wsat RCE CVE-2017-10271

pssss/CVE-2017-10271

github · Created 2018-01-16 03:10:48 UTC · 5 stars

CVE-2017-10271 Weblogic 漏洞验证Poc及补丁

kkirsche/CVE-2017-10271

github · Created 2018-01-05 21:57:03 UTC · 126 stars

Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)

Luffin/CVE-2017-10271

github · Created 2017-12-28 07:19:13 UTC · 29 stars

CVE-2017-10271 POC

c0mmand3rOpSec/CVE-2017-10271

github · Created 2017-12-28 01:30:50 UTC · 142 stars

WebLogic Exploit

s3xy/CVE-2017-10271

github · Created 2017-12-25 06:11:54 UTC · 22 stars

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

1337g/CVE-2017-10271

github · Created 2017-12-23 13:04:23 UTC · 38 stars

CVE-2017-10271 WEBLOGIC RCE (TESTED)

Oracle WebLogic Server - Remote Command Execution

nuclei · Created Unknown

oracle_weblogic_wsat_deserialization_rce

metasploit · Created Unknown

Metasploit module for CVE-2017-10271

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

22 Jun 2026 14:21 UTC 27 days ago

22 Jun 2026 14:21 UTC · 27 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
12 Jun 2026 00:32 UTC about 1 month ago

12 Jun 2026 00:32 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
12 Jun 2026 00:32 UTC about 1 month ago

12 Jun 2026 00:32 UTC · about 1 month ago

Indicators of compromise added (26)

Indicators of compromise recorded
30 May 2026 00:00 UTC about 2 months ago

30 May 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
28 Apr 2025 15:02 UTC about 1 year ago

28 Apr 2025 15:02 UTC · about 1 year ago

Metasploit module available

Exploit module available
25 Apr 2025 00:00 UTC about 1 year ago

25 Apr 2025 00:00 UTC · about 1 year ago

Nuclei template available

Scanner coverage available
10 Feb 2022 00:00 UTC over 4 years ago

10 Feb 2022 00:00 UTC · over 4 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
10 Feb 2022 00:00 UTC over 4 years ago

10 Feb 2022 00:00 UTC · over 4 years ago

First public exploitation report

Exploit observed in malware
23 Dec 2017 13:04 UTC over 8 years ago

23 Dec 2017 13:04 UTC · over 8 years ago

Public PoC available

Public proof-of-concept code published
19 Oct 2017 17:00 UTC over 8 years ago

19 Oct 2017 17:00 UTC · over 8 years ago

CVE published

Vulnerability disclosed publicly
21 Jun 2017 00:00 UTC about 9 years ago

21 Jun 2017 00:00 UTC · about 9 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2017-10271

{
  "cve_id": "CVE-2017-10271",
  "title": "Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middle...",
  "affected_vendor": "Oracle Corporation",
  "affected_product": "WebLogic Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.5,
  "epss_score": 0.99993,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2017-10271

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 39 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API