Technical intelligence and weaponization dossier for CVE-2017-10271. Documented exploitation across 1 active malware families totaling 24 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-10271 |
|---|---|
| Common Name / Bulletin | Oracle WebLogic Server WLS-WSAT Remote Code Execution Vulnerability (Oracle Critical Patch Update) |
| CWE Classification | CWE-502: Deserialization of Untrusted Data in XMLDecoder |
| Affected Software & Versions | Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 |
| Technical Root Cause | Vulnerability in WLS-WSAT component of WebLogic Server caused by unsafe XML deserialization via XMLDecoder, allowing unauthenticated attackers to execute arbitrary system commands. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| crysis | Ransomware | 24 | Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emer... |
Threat intelligence confirms the following adversaries weaponize CVE-2017-10271 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-10271 in enterprise networks:
HTTP POST requests to URI paths /wls-wsat/CoordinatorPortType or /wls-wsat/RegistrationPortType containing <java> and <void method="exec"> XML tags.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →