CVE-2017-3248

CRITICAL

Oracle WebLogic Server <12.2.1.1 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2017-3248. PoCs published by bobsecq, 0xn0ne, BabyTeam1024, including Metasploit module exploits/multi/misc/weblogic_deserialize_unicastref.

AI-analyzed exploit summary This exploit leverages Java deserialization in Oracle WebLogic's RMI Registry (CVE-2017-3248) to achieve remote code execution. It uses ysoserial to generate a malicious JRMPClient payload and sends it to the target server.

Description

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Exploits (5)

exploitdb WORKING POC
by bobsecq · pythonwebappsmultiple
https://www.exploit-db.com/exploits/44998

This exploit leverages Java deserialization in Oracle WebLogic's RMI Registry (CVE-2017-3248) to achieve remote code execution. It uses ysoserial to generate a malicious JRMPClient payload and sends it to the target server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server (10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1)
No auth needed
Prerequisites: ysoserial.jar · network access to target WebLogic server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 2,072 stars
by 0xn0ne · poc
https://github.com/0xn0ne/weblogicScanner

This repository contains a WebLogic vulnerability scanner that checks for multiple CVEs, including CVE-2018-2628. It is a Python-based tool designed to detect vulnerabilities in Oracle WebLogic Server by sending crafted requests and analyzing responses.

Classification
Scanner 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server
No auth needed
Prerequisites: Network access to the target WebLogic Server · Python 3.6 or higher
devstral-2 · analyzed Feb 15, 2026 Full analysis →
nomisec WORKING POC
by BabyTeam1024 · poc
https://github.com/BabyTeam1024/CVE-2017-3248

This repository contains a functional exploit for CVE-2017-3248, a deserialization vulnerability in Oracle WebLogic Server. The PoC includes code to execute commands, upload files, and establish a reverse shell via RMI.

Classification
Working Poc 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server
No auth needed
Prerequisites: Network access to the target WebLogic Server · T3/T3S protocol access
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Andres Rodriguez · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/weblogic_deserialize_unicastref.rb

This Metasploit module exploits a deserialization vulnerability in Oracle WebLogic Server (CVE-2017-3248) via RMI UnicastRef to achieve remote code execution. It crafts a malicious serialized object to trigger payload execution on vulnerable targets.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Oracle WebLogic Server (versions 10.3.6.0, 12.1.3.0, 12.2.1.1 and below)
No auth needed
Prerequisites: Network access to the T3 interface of Oracle WebLogic Server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (8)

Core 8
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44998/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95465
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037632
Third Party Advisory x_refsource_misc
https://www.tenable.com/security/research/tra-2017-07

Scores

CVSS v3 9.8
EPSS 0.9725
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

Status published
Products (8)
Oracle/WebLogic Server 10.3.6.0
Oracle/WebLogic Server 12.1.3.0
Oracle/WebLogic Server 12.2.1.0
Oracle/WebLogic Server 12.2.1.1
oracle/weblogic_server 10.3.6.0.0
oracle/weblogic_server 12.1.3.0.0
oracle/weblogic_server 12.2.1.0.0
oracle/weblogic_server 12.2.1.1.0
Published Jan 27, 2017
Tracked Since Feb 18, 2026