Vulnerability record · CVE-2024-21182 · published 16 July 2024
CVE-2024-21182: Oracle WebLogic Server unauthenticated data exposure via T3/IIOP
Oracle · Weblogic Server
Oracle WebLogic Server Core contains an easily exploitable flaw reachable over the network through T3 and IIOP that allows an unauthenticated attacker to access critical data. It affects supported versions 12.2.1.4.0 and 14.1.1.0.0, and the record does not specify the underlying weakness beyond 'insufficient information'.
Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
critical priorityIt is in CISA KEV with a near-term due date and very high EPSS, and it allows unauthenticated network attackers to read critical data.
What it is
Oracle WebLogic Server Core contains an easily exploitable flaw reachable over the network through T3 and IIOP that allows an unauthenticated attacker to access critical data. It affects supported versions 12.2.1.4.0 and 14.1.1.0.0, and the record does not specify the underlying weakness beyond 'insufficient information'.
Impact
An attacker gains unauthorized read access to critical data, up to all data accessible through the WebLogic Server. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reachable over the network via the T3 and IIOP protocols; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
CISA added it to the Known Exploited Vulnerabilities catalog with a 2026-06-04 remediation due date, and EPSS shows a 30-day probability of 0.74162 (99.46th percentile), indicating active exploitation is expected or observed.
What to do
- Apply the Oracle July 2024 Critical Patch Update for WebLogic Server 12.2.1.4.0 and 14.1.1.0.0.
- If patching cannot be done immediately, restrict network access to T3 and IIOP ports to trusted hosts only.
- Disable or filter T3/IIOP where not required by applications.
- Follow CISA BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
- Monitor vendor advisories for updated guidance.
Detection
- Monitor network traffic for unexpected T3 or IIOP connections to WebLogic servers from untrusted sources.
- Alert on anomalous data access patterns or large outbound transfers from WebLogic hosts.
- Review WebLogic logs for unusual T3/IIOP requests or errors that may indicate exploitation attempts.
- Correlate with CISA KEV and EPSS indicators for this CVE in vulnerability management dashboards.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-21182 to the Known Exploited Vulnerabilities catalog on 1 June 2026 as "Oracle WebLogic Server Unspecified Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 4 June 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.oracle.com/security-alerts/cpujul2024.html | Vendor Advisory |
| https://www.oracle.com/security-alerts/cpujul2024.html | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21182 | US Government Resource |
Track CVE-2024-21182 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-21182), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
