VulnSocial

CVE-2024-21182Active Exploitation(oracle / weblogic_server)

CRITICALCVSS 7.5 · HIGHCISA KEV

Exploitation observed; activity peaked at 32 mentions and remains active

Immediate actions

  • Patch oracle weblogic_server systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

oracle CVEsBack to dashboard
8.3/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-04. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories
Other references

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • weblogic_server

Threat summary

  • Active exploitation appears in 70 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 74 mentions across 11 observed days

What's happening

  • Active exploitation reported across 70 signals
  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 4 signals
  • Patch or workaround mentioned in 30 signals
  • Technical details provided in 26 signals
  • General: 3 classified signals
  • Peaked 9d ago at 32 mentions (2026-06-02); latest day: 1
  • 74 total mentions across 11 days

Affected systems

Vendors
oracle
Products
weblogic_server

2 versions affected across 1 product

Deep dive

Activity timeline74 mentions / 11d
08162432Mentions · 2026-06-01: 3Mentions · 2026-06-02: 32Mentions · 2026-06-03: 24Mentions · 2026-06-04: 5Mentions · 2026-06-05: 2Mentions · 2026-06-06: 1Mentions · 2026-06-09: 1Mentions · 2026-06-10: 1Mentions · 2026-06-18: 3Mentions · 2026-06-24: 1Mentions · 2026-09-10: 1PoC Mentioned / Linked · 2026-06-02: 4Exploit Tool / Code · 2026-06-02: 2Active Exploitation · 2026-06-01: 3Active Exploitation · 2026-06-02: 29Active Exploitation · 2026-06-03: 23Active Exploitation · 2026-06-04: 5Active Exploitation · 2026-06-05: 2Active Exploitation · 2026-06-06: 1Active Exploitation · 2026-06-09: 1Active Exploitation · 2026-06-10: 1Active Exploitation · 2026-06-18: 3Active Exploitation · 2026-06-24: 1Active Exploitation · 2026-09-10: 1Patch / Workaround · 2026-06-02: 11Patch / Workaround · 2026-06-03: 11Patch / Workaround · 2026-06-04: 4Patch / Workaround · 2026-06-05: 1Patch / Workaround · 2026-06-06: 1Patch / Workaround · 2026-06-09: 1Patch / Workaround · 2026-06-18: 1Technical Details · 2026-06-01: 1Technical Details · 2026-06-02: 11Technical Details · 2026-06-03: 6Technical Details · 2026-06-04: 2Technical Details · 2026-06-05: 1Technical Details · 2026-06-06: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-18: 306-0106-0206-0306-0406-0506-0606-0906-1006-1806-2409-10
Signal classification4 categories
Active Exploitation
6993.2%
General
34.1%
Patch
11.4%
PoC
11.4%
Referenced assets51 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-013
Active Exploitation3
2026-06-0232
Active Exploitation28General2Patch1PoC1
2026-06-0324
Active Exploitation23General1
2026-06-045
Active Exploitation5
2026-06-052
Active Exploitation2
2026-06-061
Active Exploitation1
2026-06-091
Active Exploitation1
2026-06-101
Active Exploitation1
2026-06-183
Active Exploitation3
2026-06-241
Active Exploitation1
2026-09-101
Active Exploitation1
Full discourse20 posts
  • The Hacker News@TheHackersNews
    Active Exploitation

    🚨 An actively exploited #Oracle WebLogic Server flaw has been added to CISA's KEV catalog. CVE-2024-21182 (CVSS 7.5) allows unauthenticated attackers with network access to compromise vulnerable servers and access critical data. Federal agencies must patch by June 4, 2026. Details: https://thehackernews.com/2026/06/oracle-weblogic-cve-2024-21182-added-to.html

    Post summary

    CISA added CVE‑2024‑21182 to its KEV catalog, confirming it’s being actively exploited and urging federal agencies to patch by June 4, 2026.

    34731192115.3K
    1.9M followersView on X
  • CISA Cyber@CISACyber
    Active Exploitation

    🛡️ We added Oracle WebLogic Server unspecified vulnerability CVE-2024-21182 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/acHwGfqgDW

    Post summary

    The tweet announces that CVE‑2024‑21182 has been added to the KEV Catalog, confirming it is being actively exploited in the wild.

    31725567.5K
    298.1K followersView on X
  • ボス@サイバーセキュリティの専門家@boss_sec_labo
    Active Exploitation

    6月2日、2年前と19年前の脆弱性が現役で殴ってくる。 AIは43日のパッチ運用を平気で追い越す時代だ。本日11本、現場直撃のリスト。 ・TP-Link Archer BE450/BE7200、OSコマンド注入の脆弱性(JVN/JPCERT) ・Oracle WebLogic CVE-2024-21182、CISAがKEV登録で緊急対応 ・りそなHD、生成AIセキュリティリスク専門チームを社内新設 ・Linux Kernelに19年物の脆弱性、低権限→root取得PoC公開 ・HP VoIP電話CVE-2026-0826、SDP解析でroot奪取の踏み台化 ・WP Maps Pro CVE-2026-8732、CVSS 9.8で管理者乗っ取り進行中 ・IPA、OT/ICSリスク分析の講義動画をYouTubeで公開 ・市立奈良病院システム障害、専門家会議が初会合で原因究明へ ・広島県、新聞広告QRが管理者ページ直結で86人分閲覧可能 ・AI悪用が中央値43日のパッチ運用を置き去り、対応自動化必須 ・Anthropic、防御特化AI「Claude Mythos Preview」を約150組織に拡大 古傷を抱えた古い箱が、君の現場にも一台はあるはずだ。 19年前のCVEと43日のパッチ運用、君ならどちらの時計から巻き直す？

    Post summary

    The article highlights several active, high‑impact vulnerabilities with ongoing exploitation reports and publicly released PoCs, while not providing patches or false‑positive clarifications.

    0512863.7K
    1.2K followersView on X
  • Nicolas Krassas@Dinosn
    PoC

    Oracle WebLogic T3/IIOP OpaqueReference JNDI injection → unauthenticated RCE lab, https://github.com/dinosn/CVE-2024-21182

    Post summary

    A public Proof‑of‑Concept (PoC) is available on GitHub for CVE‑2024‑21182, demonstrating an unauthenticated RCE in Oracle WebLogic via JNDI injection.

    0301383.3K
    158.6K followersView on X
  • Modat@modat_magnify
    Active Exploitation

    ⚠️ Oracle WebLogic – Actively Exploited Vulnerability Added to CISA KEV (CVE-2024-21182)  CISA has added CVE-2024-21182 to its KEV catalogue following evidence of active exploitation in the wild. The vulnerability affects the Core component of Oracle WebLogic Server and allows unauthenticated attackers with network access via T3 or IIOP protocols to compromise affected servers, potentially resulting in unauthorized access to all WebLogic-accessible data.  Originally patched in Oracle's July 2024 Critical Patch Update, this flaw is now confirmed exploited. Federal agencies are required to patch by June 4, 2026.   Affected versions:  WebLogic Server 12.2.1.4.0  WebLogic Server 14.1.1.0.0    Mitigation: Apply Oracle's July 2024 Critical Patch Update immediately. If patching is not immediately possible, consider blocking external access to T3/IIOP (default port 7001) and restricting exposure to trusted networks only.  Modat Magnify Query: web.headers~"WebLogic Server"  The platform: https://magnify.modat.io/  Reference: https://www.oracle.com/security-alerts/cpujul2024.html  #threatintel #vulnerability #CVE202421182 #Oracle #WebLogic #infosec #Critical #KEV #ModatMagnify

    Post summary

    CISA has identified CVE‑2024‑21182 as actively exploited in the wild, urging rapid patching with Oracle's July 2024 update and suggesting network restrictions as interim mitigations.

    140831.7K
    1.7K followersView on X
  • Nicolas Krassas@Dinosn
    Active Exploitation

    Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation https://thehackernews.com/2026/06/oracle-weblogic-cve-2024-21182-added-to.html

    Post summary

    Oracle WebLogic CVE-2024-21182 has been added to the KEV catalog due to confirmed active exploitation; the article provides no PoC, exploit code, patch, or technical details.

    050811.3K
    158.6K followersView on X
  • piyokango@piyokango
    Active Exploitation

    米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/1追加） 🛡No.1608 CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability ===================================== ✅概要 ・深刻度：重要 7.5 (CVSS Base) / Oracle (CNA) ・種別：情報不足 (CWE-noinfo) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Oracle Fusion Middleware の Oracle WebLogic Server の Core コンポーネントに存在する脆弱性です。 事前認証されていない攻撃者により悪用に成功した場合、重要なデータなどにアクセスされる恐れがあります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：高 ・悪用難易度：低 ✅攻撃前提条件 ・Oracle WebLogic Server 12.2.1.4.0 または 14.1.1.0.0 を使用している ・T3 または IIOP 経由でネットワークアクセス可能である ・修正済みパッチが適用されていない ・攻撃者は認証情報を必要としない ✅悪用時影響 ・重要なデータへ不正アクセスされる ・Oracle WebLogic Server からアクセス可能なすべてのデータへ不正アクセスされる ・機密情報を取得される可能性がある ✅悪用事例等に関する公開情報 ・PoC/Exploit：公開情報確認できず ・ITW：未確認 GitHub 上に CVE-2024-21182 の PoC と称する Java ファイルを含むリポジトリが確認され、WA Cyber Security Unit も PoC exploit が公開された旨を報告。 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2024-21182 ・https://www.oracle.com/security-alerts/cpujul2024.html ・https://www.cisa.gov/news-events/alerts/2026/06/01/cisa-adds-one-known-exploited-vulnerability-catalog #vulnerability

    Post summary

    The post details that the U.S. CISA confirmed active exploitation of CVE-2024-21182, notes a publicly available PoC on GitHub, and links to patch information, underscoring an ongoing threat.

    020804.7K
    43.9K followersView on X
  • Blue Team News@blueteamsec1
    Active Exploitation

    Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation https://dlvr.it/TVQL3r #Oracle #WebLogic #CVE2024 #Cybersecurity #CISA https://t.co/6XAF0OcVoU

    Post summary

    The tweet reports that CVE-2024-21182 has appeared in the KEV catalog due to active exploitation, but it provides no technical details, PoC, or patches.

    000221.6K
    57.5K followersView on X
  • Misbar | مسبار@MisbarSec
    Active Exploitation

    📌 تحذير من استغلال ثغرة في خادم Oracle WebLogic Server منذ عامين في الهجمات أصدرت CISA تحذيرًا من استغلال نشط لثغرة خطيرة في خادم Oracle WebLogic Server، والتي تم تعقبها كـ CVE-2024-21182. تمت إضافة هذه الثغرة إلى قائمة الثغرات المعروفة المستغلة (KEV) الخاصة بـ CISA. يعود تاريخ اكتشاف هذه الثغرة إلى عامين مضين، وقد تم استغلالها في هجمات. يُنصح بضرورة تطبيق التصحيحات الأمنية اللازمة لحماية الأنظمة من هذه الثغرة. 🔗 للمزيد: https://cybersecuritynews.com/oracle-weblogic-server-vulnerability-exploited/

    Post summary

    CISA alerts that CVE-2024-21182 is being actively exploited in Oracle WebLogic Server attacks and recommends installing the available security patches.

    00030655
    314 followersView on X
  • Elusive@ElusivePrivacy
    Active Exploitation

    Oracle WebLogic CVE-2024-21182 CISA Flags Active Exploitation CVE-2024-21182 patched two years ago, now actively exploited. CISA added this Oracle WebLogic unauthenticated RCE vulnerability to its Known Exploited Vulnerabilities catalog. Federal agencies ordered to patch within 4 days. Unauthenticated attackers can remotely compromise affected WebLogic servers. Sources: BleepingComputer / SecurityWeek Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw

    Post summary

    Oracle WebLogic CVE-2024-21182 is a known actively exploited unauthenticated RCE, prompting federal agencies to patch within four days.

    1101070
    185 followersView on X
  • Cyber Edition@CyberEdition
    Active Exploitation

    🛡️ CISA added Oracle WebLogic flaw CVE-2024-21182 to the KEV catalog after active exploitation was detected. The bug allows unauthenticated attacks over T3/IIOP, risking full server compromise. Patch now and lock down exposed ports. https://thecyberedition.com/cisa-oracle-weblogic-server-vulnerability-exploited/ #CyberSecurity #CISA

    Post summary

    CISA confirms that CVE-2024-21182 is actively exploited and advises immediate patching and port lockdown.

    0002149
    728 followersView on X
  • CVETrends@CVEShield
    General

    Top 5 Trending CVEs: 1 - CVE-2024-21182 2 - CVE-2026-40369 3 - CVE-2026-0257 4 - CVE-2023-41011 5 - CVE-2026-35563 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

    Post summary

    The post simply enumerates five trending CVE identifiers and provides a link to a dashboard, without offering any technical, exploitation, or patch details.

    00030203
    1.7K followersView on X
  • iototsecnews@iototsecnews
    Active Exploitation

    CISA KEV 警告 26/06/01：Oracle WebLogic Server  の脆弱性 CVE-2024-21182 を登録 https://iototsecnews.jp/2026/06/02/cisa-issues-alert-on-oracle-weblogic-server-flaw-under-active-exploitation/ 今回の問題の原因は、本来であれば内部通信用に使われるべき T3 や IIOP というプロトコルが、外部ネットワークに公開されていることにあります。脆弱性 CVE-2024-21182 の影響により、これらのプロトコルが外からアクセス可能な状態になると、認証を経ていない攻撃者であっても簡単に悪用できてしまいます。さらに、ミスコンフィグなどにより、インターネット上に公開された状態のシステムが、危険性を高める要因となっています。ご利用のチームは、ご注意ください。 #CISAKEV #CVE202421182 #Exploit #OracleWebLogicServer #Vulnerability

    Post summary

    CISA released a KEV alert on Oracle WebLogic CVE‑2024‑21182, confirming it is being actively exploited thanks to exposed internal protocols, though no PoC or patch details are provided.

    01001167
    494 followersView on X
  • ねこさん⚡(ΦωΦ)@catnap707
    Active Exploitation

    Two-year old Oracle WebLogic Server vulnerability is being exploited | CSO Online https://www.csoonline.com/article/4180218/two-year-old-oracle-weblogic-server-vulnerability-is-being-exploited.html "The vulnerability, CVE-2024-21182, was added Monday to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog,…"

    Post summary

    CISA has cataloged CVE-2024-21182 as a known exploited vulnerability, confirming active attacks in the wild.

    10100595
    3.5K followersView on X
  • Cybersecurity News Everyday@TweetThreatNews
    Active Exploitation

    CISA added CVE-2024-21182 to its exploited list. The Oracle WebLogic Server flaw affects versions 12.2.1.4.0 and 14.1.1.0.0, enabling remote unauthenticated attacks. #OracleWebLogic #CISA #Oracle https://ift.tt/iCRYOeL

    Post summary

    CISA confirmed that CVE‑2024‑21182 is actively exploited against Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, enabling remote unauthenticated attacks.

    00020180
    4.5K followersView on X
  • Elusive@ElusivePrivacy
    Active Exploitation

    CISA Adds Oracle WebLogic CVE-2024-21182 to KEV Catalog CISA has added CVE-2024-21182 an Oracle WebLogic Server vulnerability to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. FCEB agencies must remediate per BOD 22-01. WebLogic remains a frequent attack vector for malicious actors targeting enterprise Java deployments. Source: CISA Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw

    Post summary

    CISA reports that CVE‑2024‑21182 is actively exploited and urges remediation per BOD 22‑01, confirming its status as a known threat.

    0101077
    185 followersView on X
  • Cyber Netsec IO@NetSecIO
    Active Exploitation

    🚨 CISA KEV ALERT: A 2-year-old Oracle WebLogic flaw (CVE-2024-21182) is now under active attack. The RCE bug allows unauthenticated compromise. If you're running a vulnerable version, patch immediately or restrict access! #CyberSecurity #KEV #Oracle 🌐 cyber[.]netsecops[.]io https://t.co/p5mALcQUbX

    Post summary

    CISA alerts that CVE-2024-21182, an Oracle WebLogic RCE flaw, is being actively exploited, urging immediate patching or access restriction.

    0001084
    59 followersView on X
  • ねこさん⚡(ΦωΦ)@catnap707
    Active Exploitation

    2年前に修正されたOracleの脆弱性が攻撃で悪用される 米CISAが警告（CVE-2024-21182） | Codebook https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/45906/ "CVE-2024-21182として追跡されており、2024年7月にセキュリティパッチがリリースされている。影響を受けるOracle WebLogic Serverはバージョン12.2.1.4.0および14.1.1.0.0"

    Post summary

    CISA warns that the legacy Oracle WebLogic Server vulnerability CVE‑2024‑21182 is actively being exploited, and a patch has already been released.

    00001152
    3.5K followersView on X
  • JNR Management@jnrmanagement
    Active Exploitation

    🚨 CISA Adds Oracle WebLogic CVE-2024-21182 to KEV Catalog — Active Exploitation Confirmed, Federal Patch Deadline June 4, 2026. 👉 Read More: https://www.jnrmanagement.com/cisa-adds-oracle-weblogic-cve-2024-21182-to-kev-catalog-after-active-exploitation.html #CyberSecurity #JNRManagement #CISO #OracleWebLogic #CVE202421182 #CISA #KEV #PatchNow #EnterpriseSecurity https://t.co/w0ypT6wMtO

    Post summary

    CISA has confirmed that Oracle WebLogic CVE‑2024‑21182 is actively being exploited and is now listed in the KEV catalog, with a federal patch deadline set for June 4 2026. No PoC or exploit code details are provided in the post.

    0001042
    177 followersView on X
  • Lifeboat Foundation@LifeboatHQ
    Active Exploitation

    Oracle WebLogic CVE-2024–21182 Added to KEV Catalog After Active Exploitation https://lifeboat.com/blog/2026/06/oracle-weblogic-cve-2024-21182-added-to-kev-catalog-after-active-exploitation

    Post summary

    Oracle WebLogic CVE-2024‑21182 has been added to the KEV catalog following confirmed active exploitation, though the text does not detail a PoC, exploit code, or patch. The vulnerability is acknowledged to be in the wild.

    0001061
    31.3K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Apporacleweblogic_server12.2.1.4.0--
Apporacleweblogic_server14.1.1.0.0--

Explore more

Back to dashboardoracle CVEsweblogic_server vulnerabilities