CVE-2016-3510

EPSS 91.4%

Patch soon. has a working public exploit.

Vexday Risk Score

40Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 91.4%KEV nãoPoC —Nuclei simMetasploit simPatch —

Lifecycle

19 Jul 2016Metasploit module available

21 Jul 2016Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.

Affected products

n/a · n/a

References

http://packetstormsecurity.com/files/152324/Oracle-Weblogic-Server-Deserialization-MarshalledObject-Remote-Code-Execution.html https://www.tenable.com/security/research/tra-2016-21 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.securityfocus.com/bid/91787 http://www.securitytracker.com/id/1036373