CVE-2017-10271Vulnerability
Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by GreyNoise · last reported
Last reported 4 months ago
CISA KEVAdded 10 Feb 2022
Fix due 10 Aug 2022
Used by ransomware: knownCISA KEV catalogue
Fix due 10 Aug 2022
Used by ransomware: knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 14 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 14 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Hadooken and K4Spreader: The 8220 Gang's Latest Arsenal“Sekoia's WebLogic honeypot caught an infection chain exploiting CVE-2017-10271 and CVE-2020-14883 on Windows and Linux.”
-
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day“Oracle WebLogic CVE-2017-10271 RCE Attempt”
Indicators reported together
named in the same reports- 77.221.151[.]174in 1 report
- hxxp://154.213.192[.]44/Ueordwfkay.pdfin 1 report
- 154.213.192[.]44in 1 report
- hxxp://154.213.192[.]44/plugin3.dllin 1 report
- 51.222.111[.]116in 1 report
- hxxp://sck-dns[.]cc/cin 1 report
- sck-dns[.]ccin 1 report
- c4k-ircd.pwndns[.]pwin 1 report
- pwn.oracleservice[.]topin 1 report
- 80.78.24[.]30in 1 report
- play.sck-dns[.]ccin 1 report
- 77.221.149[.]212in 1 report
- irc.bashgo[.]pwin 1 report
- run.on-demand[.]pwin 1 report
- 198.199.85[.]230in 1 report
- 64.227.170[.]227in 1 report
- 157.230.29[.]135in 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2020-14883
Thanks — we review every report.