CVE-2017-1000486
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2021 - Cryptographic Failures
ASVS 5.0
V6 - Stored Cryptography Key management, algorithm strength validation
|
| Impact | Critical risk (CVSS 9.8, EPSS 93.7%). PrimeFaces is a widely-used JSF component library in Java enterprise applications. The combination of weak encryption and Java deserialization creates a devastating attack vector requiring no authentication. |
| Exploit ScenarioDerived | An attacker identifies a PrimeFaces application, derives the encryption key using known techniques, crafts a ViewState containing a serialized Commons Collections payload that executes OS commands, encrypts it with the derived key, and sends it as a POST parameter. The server decrypts and deserializes it, executing the attacker's commands. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Primetek PrimeFaces 5.x uses weak encryption for ViewState parameters, allowing unauthenticated remote code execution through crafted serialized Java objects sent via the ViewState mechanism.
Earlier versions of this analysis (1)
PrimeFaces 5.x uses a hard-coded or weak encryption key for protecting JSF ViewState data, enabling attackers to decrypt, modify, and re-encrypt ViewState to include malicious serialized Java objects for remote code execution.
RemediationAI
Upgrade PrimeFaces to 5.2.21+, 5.3.8+, or 6.0+. Configure a strong, random encryption key. Implement Java serialization filters to restrict deserializable classes.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-326 weak encryption flaw means PrimeFaces uses a static or easily derivable encryption key to protect serialized ViewState data. Attackers can brute-force or derive the key, decrypt the ViewState, inject a malicious Java deserialization payload (e.g., Commons Collections gadget chain), re-encrypt it, and send it to the server.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Executive ViewAI
Organizations using Primetek Primefaces 5.x face critical risk from CVE-2017-1000486 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.