NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Oracle WebLogic Server data-exposure flaw CVE-2024-21182 used in attacks; patches available

Attackers are exploiting CVE-2024-21182 in Oracle WebLogic Server, which runs business applications. It can expose sensitive server-accessible data without a login. Organisations should install Oracle’s fixes, available since July 2024.

What to do

Nothing for you to do on ordinary family devices: this affects business application servers. If your business uses WebLogic, ask its IT team or hosting provider to verify that Oracle’s July 2024 fix for CVE-2024-21182, or a later update containing it, is installed.

What’s happening

CVE-2024-21182 affects the Core component of Oracle WebLogic Server, software used to run business applications. Oracle lists supported versions 12.2.1.4.0 and 14.1.1.0.0 as affected. An attacker who can reach the server through its T3 or IIOP network services needs no login and could read sensitive information, potentially all data accessible to WebLogic. Oracle rates it 7.5 out of 10 and supplied fixes for both versions in its July 2024 Critical Patch Update. On 1 June 2026, CISA added the flaw to its catalogue of vulnerabilities used in attacks. The reports reviewed do not identify victims, attackers or the scale of exploitation. As of 3 November 2026, no later development was found in the search; fixes remain available, while unpatched installations remain exposed.

What
Flaw
Affects
Oracle WebLogic Server
Affected
Oracle WebLogic Server 12.2.1.4.0 (Core)
Oracle WebLogic Server 14.1.1.0.0 (Core)
Fixed in
Oracle WebLogic Server 12.2.1.4.0 with the applicable July 2024 Critical Patch Update security patch
Oracle WebLogic Server 14.1.1.0.0 with the applicable July 2024 Critical Patch Update security patch
CVE
CVE-2024-21182
Since
1 June 2026
Closed
2 June 2026

Timeline

  1. Update

    SecurityWeek reported that details of the attacks were not publicly available. The exploitation warning concerned a flaw Oracle had already patched in July 2024.

  2. CISA added

    CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It gave US federal civilian agencies until 4 June to address it.

  3. New fixFixed

    Oracle disclosed CVE-2024-21182 and included fixes in its July 2024 Critical Patch Update. Its affected supported versions were WebLogic Server 12.2.1.4.0 and 14.1.1.0.0.

Sources

  1. Oracle Critical Patch Update Advisory - July 2024Oracle · 16 July 2024
  2. Text Form of Oracle Critical Patch Update - July 2024 Risk MatricesOracle · 16 July 2024
  3. Oracle WebLogic Vulnerability Exploited in the WildSecurityWeek · 2 June 2026
  4. CISA flags two-year-old Oracle flaw as actively exploited in attacksBleepingComputer · 2 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS