Oracle WebLogic Server vulnerability (CVE-2024-21182) — risk of data compromise without authentication
In Oracle WebLogic Server, an unauthenticated attacker with network access via the T3/IIOP protocols can compromise the server, leading to unauthorized access to critical data or to all accessible data. CISA listed it as known-exploited (KEV) (CVSS 7.5 High).
Key facts
- CVE IDCVE-2024-21182
- CVSS base score7.5 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Affected (vendor / product)Oracle WebLogic Server
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-04 (U.S. federal civilian agencies, BOD 22-01)
Key points
- WebLogic Server can be compromised via T3/IIOP without authentication
- Success leads to unauthorized access to critical data (in some cases all data)
- Fixed in Oracle's July 2024 Critical Patch Update. Listed in CISA KEV (CVSS 7.5 High)
- Response: apply the relevant patch + keep T3/IIOP off the internet and restrict source addresses
- Federal civilian remediation deadline was June 4, 2026
CVE-2024-21182 is a vulnerability in Oracle WebLogic Server (a Java EE / Jakarta EE application server) in which an unauthenticated attacker can compromise the server over the network via the T3 or IIOP protocols. Success leads to unauthorized access to the critical data WebLogic Server can reach, or to all of its accessible data.
WebLogic's management protocols T3/IIOP have repeatedly been abused as an attack entry point in the past. Carelessly exposing them to the internet is dangerous because they can be reached without authentication. CISA added it to the KEV catalog on June 1, 2026 with exploitation confirmed (Oracle's fix itself was already provided in the July 2024 Critical Patch Update).
Key response: apply the relevant patch based on Oracle's July 2024 Critical Patch Update (cpujul2024). In addition, network-side mitigations are effective — do not expose T3/IIOP to the internet, and restrict them to only the required source addresses. The federal civilian remediation deadline was June 4, 2026.
Why it matters
WebLogic runs in many core systems, and danger varies greatly with internet exposure. Beyond patching, the practical priorities are inventorying the exposure of T3/IIOP and restricting access.
FAQ
What is WebLogic?
What are T3/IIOP?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).