{"id":"oracle-weblogic-data-exposure-attacks-jun-2026","category":"patch","status":"closed","title":"Oracle WebLogic Server data-exposure flaw CVE-2024-21182 used in attacks; patches available","tldr":"Attackers are exploiting CVE-2024-21182 in Oracle WebLogic Server, which runs business applications. It can expose sensitive server-accessible data without a login. Organisations should install Oracle’s fixes, available since July 2024.","summary":"CVE-2024-21182 affects the Core component of Oracle WebLogic Server, software used to run business applications. Oracle lists supported versions 12.2.1.4.0 and 14.1.1.0.0 as affected. An attacker who can reach the server through its T3 or IIOP network services needs no login and could read sensitive information, potentially all data accessible to WebLogic. Oracle rates it 7.5 out of 10 and supplied fixes for both versions in its July 2024 Critical Patch Update. On 1 June 2026, CISA added the flaw to its catalogue of vulnerabilities used in attacks. The reports reviewed do not identify victims, attackers or the scale of exploitation. As of 3 November 2026, no later development was found in the search; fixes remain available, while unpatched installations remain exposed.","action":"Nothing for you to do on ordinary family devices: this affects business application servers. If your business uses WebLogic, ask its IT team or hosting provider to verify that Oracle’s July 2024 fix for CVE-2024-21182, or a later update containing it, is installed.","product":"Oracle WebLogic Server","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2024-21182"],"tags":["oracle","weblogic","server","data-exposure","actively-exploited"],"affected":["Oracle WebLogic Server 12.2.1.4.0 (Core)","Oracle WebLogic Server 14.1.1.0.0 (Core)"],"fixed":["Oracle WebLogic Server 12.2.1.4.0 with the applicable July 2024 Critical Patch Update security patch","Oracle WebLogic Server 14.1.1.0.0 with the applicable July 2024 Critical Patch Update security patch"],"matches":[],"sources":[{"kind":"advisory","title":"Oracle Critical Patch Update Advisory - July 2024","url":"https://www.oracle.com/security-alerts/cpujul2024.html","by":"Oracle","date":"2024-07-16"},{"kind":"advisory","title":"Text Form of Oracle Critical Patch Update - July 2024 Risk Matrices","url":"https://www.oracle.com/security-alerts/cpujul2024verbose.html","by":"Oracle","date":"2024-07-16"},{"kind":"news","title":"Oracle WebLogic Vulnerability Exploited in the Wild","url":"https://www.securityweek.com/oracle-weblogic-vulnerability-exploited-in-the-wild/amp/","by":"SecurityWeek","date":"2026-06-02"},{"kind":"news","title":"CISA flags two-year-old Oracle flaw as actively exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-weblogic-flaw/","by":"BleepingComputer","date":"2026-06-02"}],"started":"2026-06-01","closed":"2026-06-02","created":"2026-11-03T22:20:12.568Z","updated":"2026-11-03T22:20:12.568Z","cve_notes":[{"cve":"CVE-2024-21182","name":"Data exposure in Oracle WebLogic Server Core","what":"An unspecified flaw in WebLogic Server’s Core component lets an attacker with network access through T3 or IIOP read sensitive data without logging in, potentially exposing all data the server can access.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-06-02","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"SecurityWeek reported that details of the attacks were not publicly available. The exploitation warning concerned a flaw Oracle had already patched in July 2024.","url":"https://www.securityweek.com/oracle-weblogic-vulnerability-exploited-in-the-wild/amp/","by":"SecurityWeek","patch":null},{"at":"2026-06-01","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It gave US federal civilian agencies until 4 June to address it.","url":"https://www.securityweek.com/oracle-weblogic-vulnerability-exploited-in-the-wild/amp/","by":"SecurityWeek","patch":null},{"at":"2024-07-16","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Oracle disclosed CVE-2024-21182 and included fixes in its July 2024 Critical Patch Update. Its affected supported versions were WebLogic Server 12.2.1.4.0 and 14.1.1.0.0.","url":"https://www.oracle.com/security-alerts/cpujul2024.html","by":"Oracle","patch":"patched"}],"url":"https://hard.fyi/live/oracle-weblogic-data-exposure-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=oracle-weblogic-data-exposure-attacks-jun-2026"}