Oracle Web Logic CVE-2024-21182 Added to KEV Catalog After Active Exploitation
Summary: CISA added CVE-2024-21182, a high-severity Oracle WebLogic Server flaw with a CVSS score of 7.5, to its Known Exploited Vulnerabilities Catalog on Monday based on evidence of active exploitation. The vulnerability, patched by Oracle in July 2024, allows an unauthenticated attacker with network access via T3 and IIOP to compromise the server and gain unauthorized access to critical data or all WebLogic Server accessible data.
Bottom line: There are no public reports yet on how the flaw is being exploited, but prior WebLogic flaws have been repeatedly weaponized by threat actors to build botnets, mine cryptocurrency, and deploy ransomware, and federal civilian agencies have until June 4, 2026 to apply fixes.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2024-21182CVE-2026-21962
- Related
- CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Known Exploited Vulnerabilities · Aug 24, 2026CVE-2024-21182: Oracle Web Logic Server Unspecified Vulnerability Known Exploited Vulnerabilities · Jun 01, 2026