CISA Flags Oracle WebLogic Bug CVE-2024-21182 as Actively Exploited
A two-year-old T3/IIOP flaw in WebLogic Server is back in the spotlight after CISA added it to the KEV catalog. Federal agencies have three weeks to patch.
CISA just dropped Oracle WebLogic Server onto its Known Exploited Vulnerabilities catalog again. The flaw is CVE-2024-21182, carrying a CVSS of 7.5.
The bug is unauthenticated and network-reachable. That's the bad combination.
An attacker with network access to a vulnerable WebLogic instance — over T3 or IIOP, the protocols that have historically been WebLogic's soft underbelly — can take control of the server without credentials. Oracle patched it in the October 2024 Critical Patch Update, crediting researcher Gaoning Pan for the report. Affected versions are 12.2.1.4.0 and 14.1.1.0.0.
The vendor's mitigation guidance for this whole class of bug hasn't changed in years: if you don't need T3 and IIOP exposed, firewall them off using WebLogic's connection filters. Most shops don't, and that's why we keep ending up here.
CISA didn't publish indicators of compromise or name a threat actor. The KEV listing is the signal: someone is using this against real targets. Federal civilian agencies have until the standard three-week deadline to patch or stop using the product. Everyone else should treat that timeline as a strong hint rather than a suggestion.
WebLogic has a long rap sheet. CVE-2017-10271, CVE-2019-2725, CVE-2020-14882 — all unauthenticated RCEs, all enthusiastically adopted by cryptominers and ransomware crews within days of disclosure. The 5pmole and Kinsing mining operations have made a small career out of internet-exposed WebLogic. If history holds, CVE-2024-21182 is now feeding the same pipeline.
This isn't an AI-flavored story, but it rhymes with one I keep writing: old enterprise middleware, deserialization-adjacent attack surface, a patch that's been available for over a year, and exploitation in the wild anyway. The Java deserialization family of WebLogic bugs is the enterprise equivalent of a SQL injection that nobody can quite kill, because the protocols predate the threat model.
What to do this week:
- Inventory WebLogic 12.2.1.4.0 and 14.1.1.0.0 instances, including the ones living inside vendor appliances you forgot you owned.
- Apply the October 2024 CPU, or at minimum restrict T3/IIOP via connection filters to known management hosts.
If you're running WebLogic on the public internet without a filter in front of it in late 2025, the patch is the second problem. The first is the architecture.
CISA's KEV entry is here. Oracle's advisory text lives inside the October 2024 CPU linked above.
