Oracle WebLogic Server vulnerability (CVE-2024-21182) — risk of data compromise without authentication
In Oracle WebLogic Server, an unauthenticated attacker with network access via the T3/IIOP protocols can compromise the server, leading to unauthorized access to critical data or to all accessible data. CISA listed it as known-exploited (KEV) (CVSS 7.5 High).
Key facts
- CVE IDCVE-2024-21182
- CVSS base score7.5 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Affected (vendor / product)Oracle WebLogic Server
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-04 (U.S. federal civilian agencies, BOD 22-01)
Key points
- WebLogic Server can be compromised via T3/IIOP without authentication
- Success leads to unauthorized access to critical data (in some cases all data)
- Fixed in Oracle's July 2024 Critical Patch Update. Listed in CISA KEV (CVSS 7.5 High)
- Response: apply the relevant patch + keep T3/IIOP off the internet and restrict source addresses
- Federal civilian remediation deadline was June 4, 2026
- T3 and IIOP exposed to the internet are reachable without authentication, so restricting sources buys time before the fix.
1The WebLogic Server flaw
CVE-2024-21182 is a vulnerability in Oracle WebLogic Server (a Java EE / Jakarta EE application server) in which an unauthenticated attacker can compromise the server over the network via the T3 or IIOP protocols. Success leads to unauthorized access to the critical data WebLogic Server can reach, or to all of its accessible data.
2Why T3 and IIOP keep being targeted
WebLogic's management protocols T3/IIOP have repeatedly been abused as an attack entry point in the past. Carelessly exposing them to the internet is dangerous because they can be reached without authentication. CISA added it to the KEV catalog on June 1, 2026 with exploitation confirmed (Oracle's fix itself was already provided in the July 2024 Critical Patch Update).
3Whether it is exposed decides the outcome
T3 and IIOP, WebLogic's management protocols, have repeatedly served as an entrance for attacks. Whether they can be reached decides how dangerous this vulnerability is.
- 1T3 or IIOP is exposedA management protocol becomes reachable from the internet
- 2It is reached without authenticationAn unauthenticated attacker touches the server over the network
- 3Data is accessedCritical data accessible to WebLogic Server, or all of its data, is reached
Oracle's fix has been available since the July 2024 Critical Patch Update. Alongside applying it, network mitigations — not exposing T3 or IIOP to the internet, restricting to necessary sources — remain effective, and they also buy time before the fix is applied.
Why it matters
WebLogic runs in many core systems, and danger varies greatly with internet exposure. Beyond patching, the practical priorities are inventorying the exposure of T3/IIOP and restricting access.
FAQ
What is WebLogic?
What are T3/IIOP?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).