CISA orders agencies to patch critical Oracle WebLogic Server vulnerability

Bleeping Computer reports that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive to government agencies mandating the immediate patching of Oracle WebLogic Server systems against a critical vulnerability, CVE-2024-21182. This flaw, despite being patched by Oracle two years ago, is now actively being exploited by threat actors.

The vulnerability, CVE-2024-21182, affects Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. It allows unauthenticated attackers with network access to compromise the server remotely with low complexity. Successful exploitation can lead to unauthorized access to critical data or complete control over accessible data within the server. CISA added this vulnerability to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to apply patches by June 4, as per Binding Operational Directive 22-01.

While the directive specifically targets federal agencies, CISA strongly urges private sector organizations to also patch their systems promptly. The agency highlighted that such vulnerabilities are frequent attack vectors and pose significant risks. Internet intelligence platform Shodan has identified over 1,592 exposed Oracle WebLogic servers potentially vulnerable to this exploit.

Source: Bleeping Computer