What is the CVSS score of CVE-2017-1000486?

CVE-2017-1000486 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 93.7%.

Is there a public PoC exploit available for CVE-2017-1000486?

Yes, a public proof-of-concept exploit is available for CVE-2017-1000486. Prioritise patching immediately. EPSS: 93.7%.

How to fix or mitigate CVE-2017-1000486?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

CVE-2017-1000486

CRITICAL

Inadequate Encryption Strength (CWE-326)

2018-01-03 cve@mitre.org

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 26, 2026 - 11:18 vuln.today

Added to CISA KEV

Nov 05, 2025 - 19:24 cisa

CISA KEV

PoC Detected

Nov 05, 2025 - 19:24 vuln.today

Public exploit code

CVE Published

Jan 03, 2018 - 20:29 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

12 maven packages depend on org.primefaces:primefaces (11 direct, 1 indirect)

Ecosystem-wide dependent count for version 5.0.

DescriptionCVE.org

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

AnalysisAI

Primetek PrimeFaces 5.x uses weak encryption for ViewState parameters, allowing unauthenticated remote code execution through crafted serialized Java objects sent via the ViewState mechanism.

Technical ContextAI

The CWE-326 weak encryption flaw means PrimeFaces uses a static or easily derivable encryption key to protect serialized ViewState data. Attackers can brute-force or derive the key, decrypt the ViewState, inject a malicious Java deserialization payload (e.g., Commons Collections gadget chain), re-encrypt it, and send it to the server.

Affected ProductsAI

Primetek PrimeFaces 5.x

RemediationAI

Upgrade PrimeFaces to 5.2.21+, 5.3.8+, or 6.0+. Configure a strong, random encryption key. Implement Java serialization filters to restrict deserializable classes.

CVE-2017-1000486 vulnerability details – vuln.today

Back

CVE-2017-1000486

Severity by source

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code