CISA Flags Actively Exploited Oracle WebLogic Flaw CVE-2024-21182
Active Exploitation · 4 sources · Updated 4mo ago · First seen Jun 2, 2026
CISA added Oracle WebLogic Server vulnerability CVE-2024-21182 to its Known Exploited Vulnerabilities catalog after confirming active exploitation, and ordered U.S. federal civilian agencies to patch affected systems by June 4 under Binding Operational Directive 22-01. The flaw affects WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, carries a CVSS 7.5 rating, and can be exploited remotely by an unauthenticated attacker with network access using T3 or IIOP protocols.
Successful exploitation could expose sensitive information or give attackers full access to data reachable by the server, raising concern for both government and enterprise environments. Oracle issued fixes in July 2024, but CISA warned that WebLogic bugs are frequently used as initial access vectors, and reporting indicated more than 1,592 internet-exposed WebLogic servers may be vulnerable; private-sector organizations were also urged to patch quickly as attackers have historically leveraged WebLogic flaws for botnets, cryptomining, and ransomware activity.
