CVE-2024-21182

CVE-2024-21182 is a vulnerability in the Core component of Oracle WebLogic Server (part of Oracle Fusion Middleware) affecting supported releases 12.2.1.4.0 and 14.1.1.0.0. It is easily exploited by an unauthenticated attacker who has network reachability to the server over the T3 or IIOP protocols, with no credentials or user interaction required. A successful attack grants unauthorized access to critical data, potentially complete access to all data accessible to Oracle WebLogic Server, which is reflected in the confidentiality-only CVSS 3.1 base score of 7.5 (C:H/I:N/A:N). Any organization running an affected WebLogic version, especially where T3/IIOP listeners are reachable from the internet or from less-trusted network zones, is exposed. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-01, and its EPSS score of 74.2% (99th percentile) signals a high probability of continued exploitation, although no public proof-of-concept is known.

What to do: Apply the Oracle WebLogic security patch that fixes CVE-2024-21182 (delivered in Oracle's July 2024 Critical Patch Update) on versions 12.2.1.4.0 and 14.1.1.0.0, or upgrade to a patched release; as an interim mitigation, restrict T3/IIOP listener access to trusted hosts and networks. US federal agencies must follow BOD 22-01 timelines, and all defenders should hunt for exploitation activity given the KEV listing on 2026-06-01.