WebLogic CVE-2024-21182: T3/IIOP Flaw Exploited in 2026

What to do

1. List WebLogic servers and their applied patches with $ORACLE_HOME/OPatch/opatch lspatches.
2. Apply the current WebLogic patch set update, which also covers CVE-2024-21181 and later fixes.
3. Block T3/T3S and IIOP from the internet and untrusted networks, and allow them only from known application hosts.
4. Disable IIOP on servers that do not use it.
5. On servers that were unpatched and reachable, rotate credentials the domain stores and hunt for signs of access.

How to check if you are affected or compromised

• Check firewall and NetFlow logs for inbound connections from unfamiliar sources to WebLogic listen ports such as 7001 that carry T3 or IIOP rather than HTTP.
• Look for outbound connections from WebLogic hosts to unfamiliar LDAP, RMI or HTTP endpoints, a common sign of WebLogic JNDI-style exploitation.
• Alert on the WebLogic Java process spawning shells, and review the domain for unknown users or deployments.
• Review data sources and credential stores the domain can reach for unusual access around and after June 2026.

What happened#

On July 16, 2024, Oracle's July 2024 Critical Patch Update fixed CVE-2024-21182 in the Core component of WebLogic Server. The CVE record calls it "easily exploitable." It lets an unauthenticated attacker with network access via T3 or IIOP compromise the server, gaining "unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data." Oracle scored it CVSS 3.1 7.5, with confidentiality impact only. Oracle's credits name Boogipop, J0hNs0N of Qianxin wuji Lab, yemoli and yulate. The same update fixed two sibling T3/IIOP bugs: CVE-2024-21181, scored 9.8, and CVE-2024-21183, scored 7.5.

Exploit code followed. Cyber Security News reported on December 30, 2024 that a proof of concept had been released on GitHub. Nearly two years after the patch, on June 1, 2026, CISA added the CVE to KEV "based on evidence of active exploitation." The catalog entry set an unusually short federal deadline of June 4. Ransomware use is listed as unknown.

Who is affected#

WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 without the July 2024 or later patches, per Oracle and NVD. The attacker must reach the T3 or IIOP protocol. A server that accepts only HTTP traffic from untrusted networks is much harder to reach.

Do you really need to act?#

Why it was added in 2026 is not public. The Hacker News wrote that "there are currently no public reports about how the vulnerability is being exploited in the wild." CSO Online reported that a CISA spokesperson pointed to the catalog's inclusion criteria but did not explain the two-year gap. No threat actor, campaign or victim count had been disclosed as of Oct 23, 2026.

What is clear is the shape of the risk. The bug needs no login, CISA's enrichment rates it "automatable," and exploit code has been public since late 2024. "All accessible data" on an application server can include stored credentials and data source passwords. So if you run an unpatched 12.2.1.4 or 14.1.1 server with T3 or IIOP open to untrusted networks, patch it now. Everyone else should confirm they are not that server. That is why the verdict is check exposure.

What to do now#

1. On each WebLogic host, run $ORACLE_HOME/OPatch/opatch lspatches and confirm a patch set update from July 2024 or later.
2. Apply the current WebLogic patch set update, not just July 2024. Later WebLogic-related bugs, such as the proxy plug-in flaw CVE-2026-21962, are also in KEV.
3. Block T3/T3S and IIOP at the network edge, and allow them only from the application hosts that need them.
4. Disable IIOP on servers that do not use it.
5. If a server was unpatched and reachable, rotate the passwords and keys stored in the domain, then run the hunt below.

How to tell if you were hit#

• Check firewall and NetFlow logs for inbound connections from unfamiliar sources to WebLogic listen ports, often 7001, that carry T3 or IIOP rather than HTTP.
• Look for outbound connections from WebLogic hosts to unfamiliar LDAP, RMI or HTTP endpoints. These are a common sign of WebLogic JNDI-style exploitation.
• Alert on the WebLogic Java process spawning sh, bash or cmd.exe, and review the domain for unknown users or deployments.
• Review databases and credential stores the domain can reach for unusual access around and after June 2026.

Timeline#

• Jul 16, 2024 — Oracle releases the fix in the July CPU.
• Dec 30, 2024 — Press reports a public proof of concept on GitHub.
• Jun 1, 2026 — CISA adds CVE-2024-21182 to KEV.
• Jun 4, 2026 — Federal remediation deadline.

Vulnerability records

• CVE-2024-21182 · KEV 2026-06-01 · Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Oracle — Critical Patch Update Advisory, July 2024 oracle.com
2. CVE record — CVE-2024-21182 cve.org
3. NVD — CVE-2024-21182 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2024-21182 cisa.gov
5. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Jun 1, 2026) cisa.gov
6. Cyber Security News — PoC released for Oracle WebLogic Server vulnerability CVE-2024-21182 cybersecuritynews.com

Coverage and analysis

1. The Hacker News — Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation thehackernews.com
2. CSO Online — Two-year old Oracle WebLogic Server vulnerability is being exploited csoonline.com