CVE-2024-21182

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2024-21182 7.5

Oracle · WebLogic Server · Added 2026-06-01 · Published 2024-07-16

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityOracle WebLogic Server Unspecified Vulnerability

VendorOracle

ProductWebLogic Server

Date added2026-06-01

Due date2026-06-04

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Descriptions

KEV: Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

NVD: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 04:41 UTC

Searches5

Component defaultyes

Sources https://www.oracle.com/security-alerts/cpujul2024.html
https://www.oracle.com/security-alerts/cve_2024_21182.html
https://github.com/dinosn/CVE-2024-21182
https://github.com/k4it0k1d/CVE-2024-21182
https://github.com/fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
https://github.com/kursadalsan/CVE-2024-21182
https://www.securityweek.com/oracle-weblogic-vulnerability-exploited-in-the-wild/
https://www.sentinelone.com/vulnerability-database/cve-2024-21182/
https://cipherssecurity.com/cve-2024-21182-oracle-weblogic-rce-cisa-kev/
https://www.wiz.io/vulnerability-database/cve/cve-2024-21182
https://docs.oracle.com/middleware/11119/wls/CNFGD/network.htm
https://blogs.night-wolf.io/cve-2024-21182-oracle-weblogic-server
https://cve.circl.lu/vuln/cve-2024-21182
https://www.cisa.gov/news-events/alerts/2026/06/01/cisa-adds-one-known-exploited-vulnerability-catalog

Hunting hypothesis agent

Hunt for unauthenticated T3/IIOP binds of AggregatableOpaqueReference objects with external LDAP URLs in their MessageDestinationReference referent, triggering server-side JNDI resolution to attacker-controlled hosts on WebLogic port 7001.

Research details

ComponentCore - weblogic.ejb.container.internal.AggregatableOpaqueReference class (JNDI injection via T3/IIOP protocols)

PreconditionsThe attacker must have network access to a vulnerable Oracle WebLogic Server instance (versions 12.2.1.4.0 or 14.1.1.0.0) with the T3 protocol (default port 7001) or IIOP protocol exposed and accessible from the attacker's network. No authentication or user interaction is required. The attacker crafts a malicious AggregatableOpaqueReference object whose private referent field is set to a MessageDestinationReference, binds it to the server's JNDI tree via T3/IIOP, and triggers a server-side JNDI lookup to an attacker-controlled LDAP/HTTP server, resulting in arbitrary code execution. The target must not have the October 2024 Critical Patch Update applied, and the JDK must have com.sun.jndi.ldap.object.trustURLCodebase enabled for full RCE (otherwise SSRF is achievable). agent

DeliveryT3/IIOP protocol (unauthenticated network-based JNDI injection)

Public PoCyes

PoC URLs https://github.com/dinosn/CVE-2024-21182
https://github.com/k4it0k1d/CVE-2024-21182
https://github.com/fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE
https://github.com/kursadalsan/CVE-2024-21182 Third-party repos; verify before use.

Advisoryhttps://www.oracle.com/security-alerts/cpujul2024.html

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0–8.9) | Multiple public PoCs available with Docker-based lab environments enabling one-command validation; exploitation requires no authentication and is automatable

SummaryOracle WebLogic Server | Public PoCs identified on GitHub (4 repositories) | T3/IIOP JNDI injection via AggregatableOpaqueReference bypass of CVE-2023-21839 patch | Vendor advisory located

Tia coverage

First reported2026-06-02

First exploit report2026-06-02

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-oracle-weblogic-cve-2024-21182-to-kev-unauthenticated

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.