CVE-2017-10271

The CVSS 3.0 score of 7.5 for CVE-2017-10271 is a dangerous misread of reality. This flaw enabled unauthenticated remote code execution against Oracle WebLogic through the T3 protocol's acceptance of Java ObjectInputStream from any network source. The base score's emphasis on Availability impact rather than Confidentiality or Integrity reflects a scoring artifact, not attacker capability — when you can execute arbitrary code as the WebLogic process user, the distinction between which CVSS metric gets weighted is academic. What matters operationally is the EPSS score of 0.99993, which signals near-certain exploitation probability, and CISA's explicit confirmation of active exploitation in the wild. Relying on the base score to deprioritize this behind other 7.5s that lack mass exploitation tooling is a decision that will get organizations compromised. The deeper problem is that Java deserialization vulnerabilities in network-exposed server software follow a documented pattern: a gadget chain is discovered, a blocklist patch is applied, the next gadget chain bypasses it, and the cycle repeats. Oracle's patch for this CVE blocked specific class names in the WLS Security component — a surgical workaround that addressed the attack vector without eliminating the architectural weakness. The vulnerable ObjectInputStream path through T3 persists in every patched instance, buried under friction that competent researchers defeat within months. CVE-2019-2725 proved this by exploiting the same pattern through a different class in the same code path. For deserialization flaws in widely-deployed middleware, treat the CVSS-EPSS divergence itself as a signal. When a base score of 7.5 pairs with an EPSS above 0.99, the organizational response gap created by the lower score becomes the actual blast radius — organizations scheduling two-week patch cycles because the severity

Reviewed through automated stages and approved by a human before publication.