CVE-2017-3506: Oracle WebLogic Server OS command injection via Web Services

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-maximum EPSS score and allows unauthenticated remote compromise of confidentiality and integrity on internet-facing WebLogic servers.

What it is

CVE-2017-3506 is an OS command injection flaw in the Oracle WebLogic Server Web Services subcomponent affecting versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. An unauthenticated network attacker can reach it over HTTP and gain both read and write access to WebLogic-accessible data, making it a serious risk for internet-facing deployments.

Impact

Successful exploitation lets an attacker create, delete or modify critical data and read all data accessible through the WebLogic Server, effectively compromising confidentiality and integrity of the application and its data.

Attack surface

Reached over the network via HTTP against the Web Services component; the CVSS vector shows no privileges required and no user interaction, so any host that can reach the WebLogic HTTP listener can attempt it.

Exploitation

It is listed in CISA KEV (added 2024-06-03) and has a very high EPSS probability (0.96281, 99.877th percentile), indicating active exploitation in the wild; no ransomware campaign use is documented.

What to do

• Apply the Oracle April 2017 Critical Patch Update (cpuapr2017-3236618) or a later patch for the affected WebLogic versions.
• If patching is not immediately possible, follow CISA's required action and vendor mitigations, or discontinue use of the affected product.
• Restrict network access to the WebLogic HTTP listener so only trusted hosts and management networks can reach it.
• Remove or disable the Web Services component if it is not required by the application.
• Monitor for and block exploitation attempts at the network perimeter while remediation is in progress.

Detection

• Inspect WebLogic HTTP access and server logs for unusual requests targeting Web Services endpoints, especially those containing command or shell metacharacters.
• Alert on unexpected child processes spawned by the WebLogic Java process (for example cmd.exe, /bin/sh or similar).
• Monitor for anomalous file creation, deletion or modification in WebLogic application and data directories.
• Correlate outbound network connections from the WebLogic host to unknown destinations with Web Services request activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.