CVE-2017-10271: Oracle WebLogic Server unauthenticated T3 remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with public exploits, CISA KEV listing, known ransomware use and near-maximum EPSS probability.

What it is

Oracle WebLogic Server contains a missing-authentication flaw in the WLS Security subcomponent reachable over the T3 protocol. An unauthenticated network attacker can exploit it to compromise the server, and the record notes affected versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. It matters because the flaw is trivially reachable, has public exploit code, and is listed in CISA KEV with known ransomware use.

Impact

Successful exploitation results in takeover of the Oracle WebLogic Server, giving the attacker code execution in the server's context. The CVSS vector scores only availability impact, but the KEV entry and exploit references describe remote code execution.

Attack surface

Reached over the network via the T3 protocol; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed T3 listener on an affected version is a candidate.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, EPSS 30-day probability is 0.9999, and multiple references are tagged Exploit including Exploit-DB entries.

What to do

• Apply the Oracle October 2017 CPU patch for the affected WebLogic versions listed in the advisory.
• If patching cannot be done immediately, restrict or block T3/T3S access to WebLogic servers at the network and host firewall.
• Disable the T3 protocol where it is not required, or place WebLogic admin and managed servers behind strict network segmentation.
• Monitor for and remove any web shells or unexpected JSP/WAR files left after exploitation.
• Verify no unauthorized changes to WebLogic configuration, startup scripts or deployed applications.

Detection

• Inspect WebLogic and HTTP logs for T3 traffic and for requests to paths associated with the WLS Security subcomponent.
• Hunt for unexpected JSP, WAR or class files written to WebLogic deployment directories or web roots.
• Alert on outbound connections or child processes spawned by the WebLogic Java process that are not part of normal operation.
• Correlate T3 connections from unfamiliar source IPs with subsequent file writes or process creation on the WebLogic host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.