---
title: "Oracle WebLogic CVE-2017-3506: 2017 WLS-WSAT Bug in KEV"
url: https://erroneo.us/security/briefs/oracle-weblogic-wls-wsat-cve-2017-3506-kev/
description: "Unauthenticated XML command injection in WebLogic web services, fixed in the April 2017 CPU, still used by 8220 Gang miners. Find old servers."
type: security-brief
section: "Security Digest"
date_published: 2017-04-18
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2017-3506"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Oracle WebLogic CVE-2017-3506: 2017 WLS-WSAT Bug in KEV

**Verdict: Check exposure.** Patched WebLogic is fine; any server still on a 2017-era release with /wls-wsat/ reachable is a cryptominer target and should be upgraded and checked for compromise.

- **Who must act:** Anyone running Oracle WebLogic Server 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2, alone or inside another product, especially with the server's HTTP port reachable from the internet.
- **Who can relax:** Teams on a supported WebLogic release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) with current Critical Patch Updates applied.
- **Affected:** Oracle WebLogic Server 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 without the April 2017 Critical Patch Update
- **Fixed:** April 2017 Critical Patch Update (Apr 18, 2017); Releases covered by the October 2026 CPU: WebLogic 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0
- **CVEs:** CVE-2017-3506
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every WebLogic install, including ones bundled inside other products, and record its version and applied patches.
2. Move anything on 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2 to a supported release and apply the October 2026 Critical Patch Update.
3. Check whether /wls-wsat/ and /_async/ paths answer from the internet, and block them at the proxy if nothing uses them.
4. Keep WebLogic listen ports and the admin console off the public internet.
5. On any server that was exposed while unpatched, hunt for miners and loaders before declaring it clean.

### How to check if you are affected

- Search WebLogic and proxy access logs for POST requests to /wls-wsat/CoordinatorPortType and other /wls-wsat/ or /_async/ paths from unfamiliar sources.
- Look for PowerShell, cmd.exe, sh, curl or wget launched by the WebLogic Java process.
- Check for the Trend Micro indicators: bin.ps1 fetched from 0xb9ac8092:443 (185.172.128.146), microsoft_office365.bat in a temp directory, bypass.ps1, and msbuild.exe talking to ports 9090-9092.
- Watch for sustained high CPU and outbound connections to mining pools from application servers.

## What happened

Oracle fixed CVE-2017-3506 in its [April 2017 Critical Patch Update](https://www.oracle.com/security-alerts/cpuapr2017.html). The flaw sits in the Web Services subcomponent of WebLogic Server and is exploitable over HTTP without credentials. Per [CISA](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506), a crafted HTTP request carrying a malicious XML document runs OS commands on the server. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-3506) scores it 7.4 because attack complexity is rated high; that has not stopped attackers.

Oracle's fix added a filter that inspects WorkContext XML before deserializing it. As [Trend Micro's ZDI](https://www.trendmicro.com/en/research/19/f/using-whitelisting-to-remediate-an-rce-vulnerability-cve-2019-2729-in-oracle-weblogic.html) explains, that blocklist kept missing tags. CVE-2019-2725 and CVE-2019-2729 abused the same code through the `/wls-wsat/*` and `/_async/*` endpoints, until Oracle moved to an allowlist in 2019. The real floor is "current patches applied," not "the 2017 patch applied."

Why KEV in 2024? On May 30, 2024, [Trend Micro](https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html) reported that Water Sigbin, also called the 8220 Gang, was exploiting CVE-2017-3506 and CVE-2023-21839 to install a cryptocurrency miner. On Windows, the exploit pulls `bin.ps1` from a hex-encoded address on port 443, writes `microsoft_office365.bat` to a temp folder, and loads an AES-encrypted .NET payload in memory. Linux targets get shell scripts. Trend Micro had already seen the group hit `wls-wsat/CoordinatorPortType` in [May 2023](https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolves-with-new-strategies.html). CISA added the CVE to KEV on June 3, 2024. [The Register](https://www.theregister.com/2024/06/06/oracle_weblogic_vulnerability_exploited/) notes that FireEye (now Trellix) had earlier tied the bug to break-ins at Superion Click2Gov payment servers.

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2017-3506) lists WebLogic Server 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. None of those releases appears in Oracle's [October 2026 CPU](https://www.oracle.com/security-alerts/cpuoct2026.html), which covers 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. A box still on a 2017-era build is therefore missing years of WebLogic fixes, not just this one. WebLogic also hides inside packaged applications, so check what yours run on.

## Do you really need to act?

If every WebLogic server is on a supported release with current CPUs, no. The risk is the forgotten server: an old Fusion Middleware stack, a vendor portal, or a test domain left reachable. Those are what the 8220 Gang scans for. A miner is noisy, but it proves someone ran code as the WebLogic user, and the same access could reach data-source passwords and keystores. Treat an exposed, unpatched server as compromised.

## What to do now

1. Find every install and its version: `java -cp $WL_HOME/server/lib/weblogic.jar weblogic.version`, plus `$ORACLE_HOME/OPatch/opatch lspatches` for applied patches.
2. Upgrade anything on 10.3.6.0, 12.1.3.0 or 12.2.1.0 to 12.2.1.2 to a supported release and apply the October 2026 CPU.
3. Test whether the endpoint answers from outside: `curl -sk -o /dev/null -w '%{http_code}\n' https://host:7001/wls-wsat/CoordinatorPortType`. Block `/wls-wsat/` and `/_async/` at the proxy if no application needs them.
4. Keep WebLogic listen ports and the admin console off the internet.
5. For any server that was exposed while unpatched, rotate data-source and admin credentials after you finish hunting.

## How to tell if you were hit

Search `$DOMAIN_HOME/servers/*/logs/access.log` and proxy logs for POSTs to `/wls-wsat/` or `/_async/` paths from unfamiliar addresses. In EDR data, look for `powershell.exe`, `cmd.exe`, `sh`, `curl` or `wget` spawned by the WebLogic Java process. Trend Micro's indicators include `bin.ps1` fetched from `0xb9ac8092:443` (185.172.128.146) and `microsoft_office365.bat` in a temp directory. Its 2023 report adds `bypass.ps1`, `Winscp-setup-1867.exe`, `Ebvjmba.dat` and an injected `msbuild.exe` connecting on ports 9090 to 9092. Sustained high CPU and connections to mining pools are the usual giveaway.

## Timeline

- Apr 18, 2017 — Oracle's April 2017 CPU fixes CVE-2017-3506.
- Apr 24, 2017 — The CVE record is published.
- Jun 25, 2019 — Trend Micro's ZDI describes the follow-on bypasses and Oracle's switch to an allowlist.
- May 16, 2023 — Trend Micro reports the 8220 Gang exploiting the bug via `wls-wsat/CoordinatorPortType`.
- May 30, 2024 — Trend Micro details Water Sigbin's fileless miner campaign using CVE-2017-3506 and CVE-2023-21839.
- Jun 3, 2024 — CISA adds CVE-2017-3506 to KEV; the federal deadline is June 24, 2024.
- Oct 20, 2026 — Oracle's latest CPU, the current patch floor for supported WebLogic releases.

## Sources

1. [Oracle — Critical Patch Update Advisory, April 2017](https://www.oracle.com/security-alerts/cpuapr2017.html)
2. [Oracle — Critical Patch Update Advisory, October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html)
3. [CVE record — CVE-2017-3506](https://www.cve.org/CVERecord?id=CVE-2017-3506)
4. [NVD — CVE-2017-3506](https://nvd.nist.gov/vuln/detail/CVE-2017-3506)
5. [CISA — Known Exploited Vulnerabilities: CVE-2017-3506](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506)
6. [Trend Micro — Decoding Water Sigbin's Latest Obfuscation Tricks](https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html)
7. [Trend Micro — 8220 Gang Evolves With New Strategies](https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolves-with-new-strategies.html)
8. [Trend Micro ZDI — Using whitelisting to remediate an RCE vulnerability (CVE-2019-2729) in Oracle WebLogic](https://www.trendmicro.com/en/research/19/f/using-whitelisting-to-remediate-an-rce-vulnerability-cve-2019-2729-in-oracle-weblogic.html)
9. [The Register — 7-year-old Oracle WebLogic bug under active exploitation](https://www.theregister.com/2024/06/06/oracle_weblogic_vulnerability_exploited/)

---
Source page: https://erroneo.us/security/briefs/oracle-weblogic-wls-wsat-cve-2017-3506-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt