Oracle WebLogic Server Flaw CVE-2024-21182 Added to CISA KEV Under Active Exploitation

Key findings

• CISA added Oracle WebLogic Server vulnerability CVE-2024-21182 to its KEV catalog on June 1, 2026.
• The flaw allows unauthenticated attackers to compromise WebLogic servers via T3 or IIOP protocols.
• Active exploitation has been confirmed in the wild, though no ransomware ties are currently flagged.
• Organizations should immediately apply Oracle's patches or restrict vulnerable protocols to mitigate risk.

The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog, adding a notable security flaw affecting Oracle WebLogic Server. Registered as CVE-2024-21182, this vulnerability has been confirmed as actively exploited in the wild, prompting urgent warnings for enterprise administrators to secure their deployments.\n\nCVE-2024-21182 is a high-severity vulnerability that lies within the Core component of Oracle WebLogic Server. It allows an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise the application server. Successful exploitation can lead to unauthorized access, modification, or deletion of critical data, and in some scenarios, can pave the way for complete system takeover.\n\nHistorically, Oracle WebLogic vulnerabilities are highly sought after by cybercriminals and state-sponsored threat actors. Because WebLogic servers often host sensitive business applications and sit at the edge of corporate networks, they represent high-value targets. While CISA has not officially associated this specific CVE with active ransomware campaigns in its catalog update, similar WebLogic flaws have frequently been leveraged by initial access brokers to facilitate ransomware deployment.\n\nIn line with Binding Operational Directive (BOD) 22-01, federal civilian executive branch agencies are required to remediate this vulnerability within a strict timeframe, typically three weeks from the KEV addition. For all other organizations, security defenders should immediately apply the official patches provided by Oracle. If patching is not immediately feasible, administrators should consider blocking or restricting T3 and IIOP traffic at the network perimeter to mitigate the risk of external exploitation.

The article provides further detail on the exploitation vector, noting that attackers leverage the T3 or IIOP protocols to bypass authentication controls. It also highlights that while specific threat actors have not been publicly attributed, the vulnerability's nature makes it a prime candidate for adoption in financially motivated ransomware campaigns. The article emphasizes the need for organizations to audit network exposure of WebLogic services and restrict access to T3 and IIOP protocols.