CVE-2017-3248: Oracle WebLogic Server T3 deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with CVSS 9.8, public exploit code and near-maximum EPSS makes this an urgent patch-or-isolate case.

What it is

Oracle WebLogic Server contains a remotely exploitable flaw in its Core Components, reachable over the T3 protocol, that allows an unauthenticated network attacker to compromise the server. Oracle rates it CVSS 3.0 9.8, and public exploit code exists, so any internet- or network-exposed WebLogic instance is a high-value target.

Impact

Successful exploitation results in full takeover of the WebLogic Server, with high confidentiality, integrity and availability impact. The attacker gains code execution in the server's context, which typically means control of hosted applications and their data.

Attack surface

Reached over the network via the T3 protocol; the CVSS vector shows no privileges required and no user interaction, so any host that can reach the T3 listener can attempt it. The description does not specify whether T3 is enabled by default or how it is exposed in a given deployment.

Exploitation

Not listed in CISA KEV, but EPSS is 0.973 (99.9th percentile) and public exploit references exist, including an Exploit-DB entry and a Packet Storm writeup on RMI UnicastRef deserialization RCE. This indicates mature, widely available exploitation rather than a theoretical issue.

What to do

• Apply the Oracle January 2017 Critical Patch Update for WebLogic Server (10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1) or upgrade to a fixed release.
• Restrict network access to the T3 listener; do not expose WebLogic administration or T3 ports to untrusted networks.
• Disable or filter the T3 protocol where it is not required, and block T3 traffic at the perimeter.
• Run WebLogic with least privilege and isolate it from sensitive internal networks.
• Monitor for and remove known deserialization gadget libraries from the classpath where feasible.

Detection

• Monitor T3 traffic for anomalous serialized Java objects or unexpected RMI/UnicastRef payloads.
• Alert on WebLogic server processes spawning shells or unexpected child processes.
• Review WebLogic logs for unusual T3 connection patterns, errors, or deserialization exceptions.
• Hunt for outbound connections from WebLogic hosts to unfamiliar external addresses following T3 activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.