CVE-2024-21182

nvd.nist.gov • June 2, 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Warns of Active Exploitation of Oracle WebLogic Vulnerability CVE-2024-21182 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of a two-year-old vulnerability in Oracle WebLogic Server, tracked as CVE-2024-21182. This flaw, which affects versions 12.2.1.4.0 and 14.1.1.0.0, allows unauthenticated attackers to remotely compromise servers using T3 and IIOP protocols. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch their systems by June 4, 2026. Currently, over 1,592 Oracle WebLogic servers are identified as exposed and vulnerable. Successful exploitation can lead to unauthorized access to critical data or complete control over the server. CISA has previously flagged numerous Oracle vulnerabilities, highlighting the ongoing risk posed by such flaws. Organizations are urged to apply patches immediately to mitigate potential attacks. 17 sources 73

Extracted Entities

CVE-2024-21182

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)