CVE-2017-1000486: PrimeFaces weak encryption flaw leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, confirmed KEV listing and very high EPSS make this an actively exploited, unauthenticated remote code execution flaw.

What it is

PrimeFaces 5.x uses inadequate encryption strength (CWE-326), which allows an unauthenticated remote attacker to reach code execution. The flaw is rated critical (CVSS 3.1 9.8) and is listed in CISA's Known Exploited Vulnerabilities catalog, so it is a confirmed real-world target.

Impact

An attacker can execute arbitrary code on the server hosting the affected PrimeFaces application, gaining full control of the host and its data. The CVSS vector shows high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed PrimeFaces 5.x application is in scope.

Exploitation

CISA added it to KEV on 2022-01-10 with a 2022-07-10 remediation due date, and EPSS is 0.941 (99.8th percentile), indicating active exploitation. References include an Exploit tag and an Exploit-DB entry, so public exploit code exists.

What to do

• Apply the vendor update for PrimeFaces per CISA's required action; upgrade off the vulnerable 5.x line.
• If immediate patching is not possible, remove or restrict network access to affected PrimeFaces endpoints.
• Place affected applications behind authentication and network controls so unauthenticated requests cannot reach them.
• Review the PrimeFaces issue tracking reference for the specific fix and confirm the deployed version is not 5.x.
• Treat any host running the vulnerable version as potentially compromised and check for signs of code execution.

Detection

• Monitor web logs for requests to PrimeFaces endpoints from unexpected sources or with anomalous parameters.
• Alert on outbound connections or child processes spawned by the application server that are not part of normal operation.
• Hunt for known exploit patterns against PrimeFaces in IDS/IPS and WAF telemetry.
• Inventory applications and confirm which run PrimeFaces 5.x to scope exposure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.