VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 06:08 UTC

CVE-2017-10271

Read full description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.6/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 7.5: +1.12
Fresh EPSS: 99.99%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 9 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

The Hacker News

Press · 25 Aug 2026, 07:00 · Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data - The Hacker News

CloudSEK

Press · 25 Mar 2026, 14:27 · Honey for Hackers: A Study of Attacks Targeting the Recent CVE-2026-21962 and Other Critical WebLogic Vulnerabilities on a High Interactive Oracle Honeypot - CloudSEK

Qualys

Press · 27 Dec 2019, 08:00 · Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking - Qualys

Unit 42

Press · 03 May 2019, 07:00 · Attackers Increasingly Targeting Oracle WebLogic Server Vulnerability for XMRig and Ransomware - Unit 42

Unit 42

Press · 30 Apr 2019, 07:00 · Muhstik Botnet Exploits the Latest WebLogic Vulnerability for Cryptomining and DDoS Attacks - Unit 42

See all 9 source documents

www.trendmicro.com

Press · 11 May 2018, 07:00 · Cryptominers Target Patched 2017 Oracle WebLogic Bug - www.trendmicro.com

www.trendmicro.com

Press · 26 Feb 2018, 08:00 · Oracle Server Exploited to Deliver Monero Miners - www.trendmicro.com

Google Cloud

Press · 15 Feb 2018, 08:00 · CVE-2017-10271 Used to Deliver CryptoMiners: An Overview of Techniques Used Post-Exploitation and Pre-Mining - Google Cloud

BleepingComputer

Press · 11 Jan 2018, 08:00 · Hackers Make Whopping $226K Installing Monero Miners on Oracle WebLogic Servers - BleepingComputer

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 8 repos with metrics

Repository	Stars	Forks	Language	Updated
SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961	105	33	Python	29 Apr 2019, 02:06
Luffin/CVE-2017-10271	29	15	Python	10 Jan 2018, 02:34
SuperHacker-liuan/cve-2017-10271-poc	7	0	Rust	02 Feb 2018, 07:47
pssss/CVE-2017-10271	5	3	Python	20 Jan 2020, 06:37
kbsec/Weblogic_Wsat_RCE	4	1	Python	27 Mar 2019, 17:47
pizza-power/weblogic-CVE-2019-2729-POC	3	0	Python	31 May 2021, 14:55
ZH3FENG/PoCs-Weblogic_2017_10271	3	2	Java	25 Dec 2017, 13:23
JackyTsuuuy/weblogic_wls_rce_poc-exp	1	1	Python	01 Mar 2018, 05:08

Public exploit evidence

exploitdb #43392 2017-12-26
exploitdb #43458 2018-01-03
exploitdb #43924 2018-01-29

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 7.5; EPSS 100.0%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:47.671864+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

19 Oct 2017, 17:00

First press mention

11 Jan 2018, 08:00

Added to the CISA KEV catalog

10 Feb 2022, 00:00

Latest press mention

25 Aug 2026, 07:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

8 repositories