A patched Oracle WebLogic Server vulnerability moved back to the top of federal patching queues this week after CISA said attackers are exploiting it in the wild. Initially, the flaw was first reported in January 2025 and security teams were warned a proof-of-concept exploit code was also avaible at the time.
CISA on June 1 added CVE-2024-21182 to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation. The agency gave federal civilian agencies until June 4 to apply vendor mitigations, follow cloud-service guidance under Binding Operational Directive 22-01, or discontinue use if fixes are unavailable.
The vulnerability affects Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0, part of Oracle Fusion Middleware. Oracle’s July 2024 Critical Patch Update listed CVE-2024-21182 as a WebLogic Server Core flaw reachable through T3 and IIOP, with a CVSS 3.1 score of 7.5.
NVD describes the flaw as easily exploitable by an unauthenticated attacker with network access through T3 or IIOP. T3 and IIOP are network protocols WebLogic can use to let applications, clients and WebLogic servers talk to each other.
The bug can be exploited remotely by an attacker who does not need a username, password or prior access to the system. If the attacker can reach the WebLogic server over the network through the T3 or IIOP protocols, they may be able to compromise the server.
A successful attack does not appear to let the attacker change data or crash the system, based on Oracle’s severity rating. The main risk is data exposure. Oracle says exploitation could give an attacker unauthorized access to sensitive information or even all data that the WebLogic Server can access. Oracle rated the flaw high severity with a CVSS score of 7.5 because it is easy to exploit remotely, requires no user interaction and requires no authentication.
The Western Australia SOC warned in January 2025 that proof-of-concept exploit code had been released for CVE-2024-21182, though it said at the time it had no evidence of exploitation affecting Western Australian government networks. Check Point also published IPS coverage for CVE-2024-21182 in January 2025, classifying the issue as Oracle WebLogic Server remote code execution adding it detected attempts to exploit the vulnerability.
Security teams are advised to identify exposed WebLogic instances, verify July 2024 CPU coverage or later equivalent fixes, restrict unnecessary T3 and IIOP access, and review logs for unusual unauthenticated traffic to WebLogic services.
