← Vulnerability feed

Vulnerability record · CVE-2017-10269 · published 14 November 2017

CVE-2017-10269: Oracle tuxedo vulnerability

Oracle · Tuxedo

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. While the vulnerability is in Oracle Tuxedo, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Tuxedo accessible data as well as unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Tuxedo. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L).

10.0 CVSS 3.0 Critical EPSS 2.1% · top 18.7%
10.0CVSS 3.0 base score, v2 7.5
2.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.1, 12.1.3 and 12.2.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. While the vulnerability is in Oracle Tuxedo, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Tuxedo accessible data as well as unauthorized access to critical data or complete access to all Oracle Tuxedo accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Tuxedo. CVSS 3.0 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L).

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10269-4021872.html PatchVendor Advisory
http://www.securityfocus.com/bid/101841 Third Party AdvisoryVDB Entry
http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-10269-4021872.html PatchVendor Advisory
http://www.securityfocus.com/bid/101841 Third Party AdvisoryVDB Entry

Track CVE-2017-10269 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2017-10272Oracle tuxedo vulnerabilityVulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.…EPSS 1.2%9.8CVE-2022-23305Log4j 1.x JDBCAppender SQL injection via logged inputThe JDBCAppender in Log4j 1.2.x builds SQL statements from configuration parameters and PatternLayout converters, so logged values such as the %m mes…EPSS 67%analysed8.8CVE-2022-23302Apache Log4j 1.x JMSSink JNDI deserialization remote code executionJMSSink in all versions of Log4j 1.x deserializes untrusted data when an attacker can write to the Log4j configuration or when the configuration refe…EPSS 64%analysed8.8CVE-2022-23307Apache Chainsaw and Log4j 1.2.x Deserialization of Untrusted DataCVE-2022-23307 is a deserialization of untrusted data flaw (CWE-502) that was originally identified in Apache Chainsaw as CVE-2020-9493. The same iss…EPSS 54%analysed8.6CVE-2018-3007Oracle tuxedo vulnerabilityVulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 12.1.1, 12.1.…EPSS 2.7%7.5CVE-2021-4104Apache Log4j 1.2 JMSAppender deserialization leads to remote code executionJMSAppender in Apache Log4j 1.2 deserializes untrusted data when an attacker can write to the Log4j configuration, allowing TopicBindingName and Topi…EPSS 81%analysed7.5CVE-2019-0227Apache Axis 1.4 SSRF via AdminService (expired domain)Apache Axis 1.4, last released in 2006, contains a server-side request forgery flaw in its AdminService. The service can be induced to fetch a remote…EPSS 92%analysed7.5CVE-2017-10267Oracle tuxedo information exposure vulnerabilityVulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 11.1.1, 12.1.…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2017-10269), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.