Security readout for executives and security teams
Plain-English summary
CVE-2017-10271 allows an unauthenticated network attacker to compromise specified Oracle WebLogic Server versions through T3. Successful exploitation may take over the server or make it unavailable. CISA lists the vulnerability as known exploited, making exposed legacy installations an urgent business risk.
Executive priority
Treat reachable affected systems as urgent. Assign ownership immediately, reduce T3 exposure, follow Oracle remediation guidance, and investigate possible prior compromise. Systems confirmed unaffected or unable to receive untrusted T3 traffic can follow normal risk-based scheduling after validation.
Technical view
The affected WebLogic Server versions are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, and 12.2.1.2.0. Exploitation requires network access through T3 but no credentials or user interaction. The supplied vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with a 7.5 score and CWE-306 classification.
Likely exposure
Exposure is most likely where a listed WebLogic version remains deployed and an untrusted network can reach its T3 service. The bundle does not identify vulnerable endpoints, default ports, cloud services, or reliable detection indicators. Internet-facing and broadly reachable internal instances warrant priority review.
Exploitation context
CISA KEV inclusion supports active exploitation in the wild, although the bundle does not establish when or how recently exploitation occurred. Public exploit references are also listed. No exploit procedure is included here. Assume reachable affected systems may have been targeted and assess them for compromise.
Researcher notes
The source bundle describes possible server takeover but assigns the CVSS vector only an availability impact; that discrepancy should be checked against Oracle guidance. It supplies no patch identifier, vulnerable endpoint details, indicators of compromise, or exploitation timeline. Conclusions beyond affected versions, T3 reachability, unauthenticated exploitation, and KEV status would require additional evidence.
Mitigation direction
- Identify and prioritize every deployment running a listed WebLogic version.
- Consult current Oracle guidance for the applicable security update or supported upgrade path.
- Restrict T3 access to trusted networks and systems where operationally feasible.
- Isolate exposed affected servers until vendor-directed remediation is completed.
- Perform compromise assessment before returning remediated systems to normal service.
Validation and detection
- Confirm each WebLogic Server version using authoritative asset and deployment records.
- Verify whether untrusted networks can reach T3 on each affected deployment.
- Confirm vendor-directed remediation was applied successfully to every identified instance.
- Review historical network and security telemetry for suspicious unauthenticated T3 activity.
- Escalate unexplained activity for incident-response investigation and containment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-10271 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2017-10271 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2022-02-10T00:00:00.000Z: CVE-2017-10271 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- 43458CVE reference, oracle · exploit, x_refsource_EXPLOIT-DB
- https://github.com/c0mmand3rOpSec/CVE-2017-10271CVE reference, oracle · x_refsource_MISC
- 43924CVE reference, oracle · exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-10271CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.