October 12, 2026
CyberWorldOps Cyber Security · Threat Intelligence · CVE
Newsletter
Latest

CVE-2017-10271

High7.5 Published on Oct 19, 2017

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Actively exploited

  • In the CISA exploited-vulnerabilities catalogue since Feb 10, 2022
  • US federal agencies must remediate it by Aug 10, 2022 (BOD 22-01)
  • Attacked 276 days before the vulnerability was made public
  • Confirmed by sensors, not only by reports
  • Used in ransomware campaigns

Apply updates per vendor instructions.

Source: CISA KEV · Oct 3, 2026 Oct 2, 2026 Oct 1, 2026 Sep 30, 2026 Sep 29, 2026 Sep 28, 2026

CVSS score7.5 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness type (CWE)CWE-306
Vendorsoracle

Affected products

VendorsProductVersions
oracleweblogic server10.3.6.0.0

Related articles

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database