CISA Adds Oracle WebLogic CVE-2024-21182 to KEV — Unauthenticated T3/IIOP Exploitation Confirmed

CVE-2024-21182 is an unauthenticated remote access flaw in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, reachable over the T3 and IIOP protocols. Oracle patched it in the July 2024 Critical Patch Update, yet CISA added it to the Known Exploited Vulnerabilities catalog on June 1, 2026, confirming active exploitation in the wild. The vulnerability permits attackers to gain access without credentials, making any internet-facing WebLogic instance a direct target.

This is not another generic middleware bug; it is a ransomware-level exposure on a protocol stack that attackers have targeted for years. The T3/IIOP surface has historically been used by ransomware operators to compromise enterprise application servers, and the KEV addition with a federal remediation deadline of June 4, 2026 under BOD 22-01 indicates sustained scanning and exploitation rather than isolated incidents. Unpatched WebLogic instances running the affected versions face immediate risk of full server compromise.

Defenders should apply the July 2024 CPU patches immediately and restrict network access to T3 and IIOP ports at the firewall or load-balancer layer. Hunting should focus on unexpected T3/IIOP connection attempts in WebLogic access logs, anomalous JNDI lookup patterns, and any signs of unauthorized server access. If patching is delayed, block the T3/IIOP protocols entirely for external-facing instances, since the vulnerability requires no authentication to exploit.

Watch for updated exploitation telemetry showing broader actor adoption or new post-exploitation payloads targeting WebLogic specifically. The key shift that would change this assessment is confirmation that attackers are chaining CVE-2024-21182 with additional WebLogic or fusion middleware vulnerabilities, or evidence that the scanning has expanded beyond the initially observed targets.