Is CVE-2017-12149 being actively exploited?

Yes. CVE-2017-12149 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on December 10, 2021.

What is the CVSS score for CVE-2017-12149?

CVE-2017-12149 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2017-12149

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 90.7%EU EUVD: exploited

In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
EPSS score: 90.7% (100th percentile)
In CISA KEV: Yes, added December 10, 2021
In EU EUVD: Yes (EUVD-2017-3733)
Published: October 4, 2017
NVD last modified: October 7, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Red Hat JBoss Application Server Remote Code Execution Vulnerability

Added to the KEV catalog on December 10, 2021; federal remediation due June 10, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2017-3733 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 7, 2026.

View on the EU Vulnerability Database

Affected products

redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform
redhat / jboss enterprise application platform

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

JBoss Enterprise Application Platform 5 Version 5.1.0 and 5.1.1 - Red Hat, Inc. - Common Criteria BSI-DSZ-CC-0687-2011 - archived

References

http://www.securityfocus.com/bid/100591(Third Party Advisory, VDB Entry)
https://access.redhat.com/errata/RHSA-2018:1607(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2018:1608(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=1486220(Issue Tracking)
https://github.com/gottburgm/Exploits/tree/master/CVE-2017-12149(Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12149(US Government Resource)

Last updated October 9, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain