CVE-2024-21182: Oracle WebLogic unauthenticated data exposure via T3/IIOP, exploited
The short version: CVE-2024-21182 is an unauthenticated flaw in the core of Oracle WebLogic Server that an attacker can reach over the T3 and IIOP protocols to gain unauthorized access to critical data. CISA added it to the KEV catalog on evidence of in-the-wild exploitation, with a very short deadline. The direct impact is confidentiality — but on a WebLogic server, exposed data often unlocks the next step. Steady hands: patch and get T3/IIOP off the internet.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 49.7% · 98.8th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-06-04 |
| Known exploited? | Yes — CISA added it on evidence of active exploitation (public exploitation details limited) |
| Vulnerability type | Unauthenticated data exposure via T3/IIOP (NVD: CWE-noinfo) → access to critical data |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Core) |
| Fixed in | Oracle Critical Patch Update, July 2024 |
What you need to know
WebLogic is a Java application server, and beyond HTTP it speaks the T3 and IIOP remote protocols for its internal RMI machinery — protocols that are often left reachable. CVE-2024-21182 lives in the Core component and lets an unauthenticated attacker with network access over T3/IIOP reach data they shouldn't, up to "complete access to all Oracle WebLogic Server accessible data."
Why a confidentiality-only flaw still earns priority:
- It's unauthenticated and network-reachable. No login; just reachability of the T3/IIOP listener.
- The data it exposes is load-bearing. Application data, configuration, and secrets read off a WebLogic server frequently become the credential or detail an attacker needs to escalate.
- It's confirmed exploited. CISA added it to the KEV catalog on evidence of active exploitation and set a tight remediation deadline — even though public reporting on the exact technique is thin.
How serious we see it
High — matching the 7.5 base score, with the honest caveat that impact depends on what leaks.
The vector is confidentiality-only (C:H/I:N/A:N), so this isn't takeover on its own — which is why we hold at High rather than Critical. But it's unauthenticated, it's in CISA's KEV catalog, and on a WebLogic server "read access to critical data" is rarely the end of the story; it's often step one. Rate it as a genuine priority, especially anywhere the T3/IIOP listener is exposed.
The bounded, reassuring part: it affects two specific WebLogic versions, the July 2024 fix is published, and exposure is quick to confirm.
Recommendations
Straight from Oracle's July 2024 CPU and CISA:
- Patch now. Apply the July 2024 Critical Patch Update to affected WebLogic 12.2.1.4.0 / 14.1.1.0.0.
- Restrict T3 and IIOP. Don't expose these protocols to the internet; limit them to trusted networks, and restrict management access generally.
- Hunt. Review logs for anomalous T3/IIOP activity; validate that staging and legacy WebLogic instances are patched too.
- If you find indicators, respond. Rotate any credentials or secrets that may have been exposed, and investigate for follow-on access.
- Confirm your exposure first. Verify whether you run an affected WebLogic version with T3/IIOP reachable.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing WebLogic interfaces, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited flaw so it surfaces near the top of your results — instead of being lost in a backlog. Because reliable, safe public exploitation detail is limited, BreachRisk detects and flags the exposed, affected server and its reachable protocols rather than attempting to pull data.
That outside-in view answers the first question fast — do we run an exposed WebLogic that needs this patch? — so you can act inside a tight deadline.