CVE-2024-21182: Oracle WebLogic Server Unauthenticated RCE (KEV)

Checked: 2026-10-30

CVE-2024-21182 is an easily-exploitable, unauthenticated-RCE-class vulnerability in Oracle WebLogic Server reachable over the T3 or IIOP protocols, patched in July 2024, but CISA only added it to the Known Exploited Vulnerabilities catalog in mid-2026 — two years after the fix shipped — and FIRST now scores it in the 99th EPSS percentile, so unpatched or internet-exposed WebLogic T3/IIOP endpoints should be treated as under active attack.

Vulnerability summary

Vulnerability ID	CVE-2024-21182
CVSS score	7.5
EPSS score	0.74162
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD (Oracle Secondary score only, not NVD Primary)
Published	2024-07-16T23:15:22.660

Affected components

Component	CPE	Version range
Oracle WebLogic Server	cpe:2.3:a:oracle:weblogic_server::::::::	12.2.1.4.0 and 14.1.1.0.0 (patched via Oracle Critical Patch Update, July 2024)

What this means

CVE-2024-21182 affects the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. NVD's description, drawn directly from Oracle's disclosure, states: "Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data" (NVD).

NVD's vulnerability status is "Analyzed," but no independent NVD Primary CVSS metric has been published for this CVE, and NVD has not assigned a specific CWE (its weakness field reads NVD-CWE-noinfo). The only CVSS metric on record is Oracle's own CNA-submitted Secondary score: CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-reachable, low attack complexity, no privileges or user interaction required, confidentiality-only impact. Because NVD has not independently confirmed this figure, it is reported here as Oracle's own rating, not an NVD-confirmed one (NVD).

Oracle's own July 2024 Critical Patch Update risk matrix (independently retrieved and matched by CVE ID during this review) confirms the identical figures: "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0 ... CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)." Oracle's credit statement for the same Critical Patch Update attributes the report to "J0hNs0N of Qianxin wuji Lab," "yemoli" and "yulate" (Oracle Critical Patch Update, July 2024).

CISA added CVE-2024-21182 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-01, with a required-action due date of 2026-06-04, and lists known ransomware campaign use as "Unknown" — notably, this is a roughly two-year-old CVE only now confirmed under active exploitation, a pattern CISA's KEV catalog periodically surfaces for patched-but-neglected enterprise middleware (catalog membership confirmed this run by exact cveID match against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.74162 (99.484th percentile) — among the highest EPSS scores FIRST tracks, consistent with a long-unpatched, internet-reachable WebLogic flaw now under real-world scanning and exploitation (FIRST EPSS).

Any Oracle WebLogic Server on 12.2.1.4.0 or 14.1.1.0.0 that has not applied the July 2024 Critical Patch Update (or a later one) should be patched immediately; given the attack surface is specifically the T3 and IIOP protocols, administrators who cannot patch immediately should restrict or firewall off T3/IIOP network access to WebLogic as an interim measure, and treat any already-exposed, unpatched instance as potentially compromised given the two-year gap between patch availability and confirmed KEV exploitation.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

Unauthenticated attacker with network access via T3 or IIOP can compromise Oracle WebLogic Server (component: Core), affecting versions 12.2.1.4.0 and 14.1.1.0.0. — NVD
NVD vulnStatus is Analyzed but no NVD Primary CVSS or CWE has been published; the only metric on record is Oracle's own Secondary CVSS v3.1 score of 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. — NVD
Oracle's July 2024 Critical Patch Update risk matrix independently confirms the same affected versions, component, protocol and CVSS 7.5 score, and credits J0hNs0N of Qianxin wuji Lab, yemoli and yulate with reporting it. — Oracle Critical Patch Update, July 2024
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-01, required-action due date 2026-06-04, ransomware campaign use listed as Unknown; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
EPSS score is 0.74162 (99.484th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-7755: Juniper ScreenOS Unauthorized Backdoor Authentication Bypass (KEV)CVE-2015-7755: KEV authentication bypass via a hardcoded backdoor password planted in Juniper ScreenOS, giving remote attackers admin access over SSH/Telnet. Versions, root cause and scoring sourced to NVD, CISA and public firmware analysis.CVE-2017-7921: Hikvision IP Camera Improper Authentication Bypass (KEV)CVE-2017-7921: KEV improper-authentication flaw across multiple Hikvision IP camera series lets a remote attacker escalate privileges and access video and device data without valid credentials. Versions, fix and scoring sourced to NVD, CISA ICS-CERT and Hikvision.CVE-2024-7399: Samsung MagicINFO 9 Server Path Traversal to RCE (KEV, Exploited)CVE-2024-7399: KEV path traversal in Samsung MagicINFO 9 Server lets attackers write arbitrary files as system authority, used to drop JSP webshells. Versions, scoring, sourced to NVD, CISA and Samsung.