CISA Alerts to Active Exploits of Unpatched Oracle WebLogic Flaw

CISA has issued a warning about the exploitation of an Oracle WebLogic vulnerability, identified as CVE-2024-21182, which was patched nearly two years ago. The flaw allows remote, unauthenticated hackers to gain unauthorized access to critical data on vulnerable Oracle WebLogic Server instances. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 1, instructing federal agencies to patch it by June 4. Proof-of-concept exploits have been made public, but no specific attack details have been reported.