Skip to main content
IMMUNITYSEC

CVE-2017-10271

7.5
HIGH
CVSS 3.1
EPSS 100.0% · 100th pctCISA KEV · Exploited in the wild
2017-10-19•Updated 2026-08-13•KEV 2022-02-10
CISA Known Exploited Vulnerabilities

Oracle Corporation WebLogic Server Remote Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2022-02-10
Remediation due
2022-08-10
Ransomware
Known use

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2017-10271

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Severity

CVSS 3.1 · CISA7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impactpartial

Affected Products

VendorProductAffected versions
Oracle CorporationWebLogic Server
10.3.6.0.0
12.1.3.0.0
12.2.1.1.0
12.2.1.2.0

References

6 Links
Exploits & PoCs
Vulnerability databases

Record Details

Published
2017-10-19
Last updated
2026-08-13
Assigner (CNA)
oracle
Credited to
-

More from Oracle Corporation

CVE-2020-148829.8

Oracle WebLogic Server Remote Code Execution Vulnerability

CVE-2019-27257.5

Oracle WebLogic Server, Injection

CVE-2018-26289.8

Oracle WebLogic Server Unspecified Vulnerability

CVE-2023-218397.5

Oracle WebLogic Server Unspecified Vulnerability

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.