In CISA KEV7.5 High
CVE-2024-21182
Oracle WebLogic Server Unspecified Vulnerability
OracleWebLogic Server
Status
- Exploited in the wild
- In CISA KEV since 1 Jun
- Vendor fix available
Federal deadlineThu 4 Jun, 23:59 UTC
Passed 142 days ago
CISA KEV · added 1 Jun
Exploit probabilityEPSSchecked 24 Oct
74%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
7.5High
Description NVD
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 9 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 1 Jun · 18:41 UTC | CISA | CISA flags Oracle WebLogic CVE-2024-21182 as actively exploited |
| Mon 1 Jun · 20:24 UTC | CISA | CISA Puts Oracle WebLogic Flaw CVE‑2024‑21182 on KEV List |
| Tue 2 Jun · 02:21 UTC | CISA | CISA’s KEV Catalog Helps Firms Tackle Oracle WebLogic Risk |
| Tue 2 Jun · 05:21 UTC | SecurityOnline | The Shai-Hulud Infiltration: Red Hat Exploited in Sovereign Supply Chain Breach |
| Tue 2 Jun · 07:32 UTC | SecurityOnline | Grandoreiro Banking Trojan Evades Defense via Lookalike Software |
| Tue 2 Jun · 10:32 UTC | SecurityOnline | CVE-2024-21182 Fuels SilentCryptoMiner Attack on Streaming Sites |
| Tue 2 Jun · 12:21 UTC | SecurityWeek | CISA Alerts to Active Exploits of Unpatched Oracle WebLogic Flaw |
| Tue 2 Jun · 16:32 UTC | Security Affairs | CISA adds Oracle WebLogic flaw CVE-2024-21182 to exploited list |
| Tue 2 Jun · 19:00 UTC | The Hacker News | Oracle WebLogic CVE-2024-21182 added to KEV amid active exploits |
- Oracle WebLogic CVE-2024-21182 added to KEV amid active exploitsThe Hacker News
- CISA adds Oracle WebLogic flaw CVE-2024-21182 to exploited listSecurity Affairs
- CISA Alerts to Active Exploits of Unpatched Oracle WebLogic FlawSecurityWeek
- CVE-2024-21182 Fuels SilentCryptoMiner Attack on Streaming SitesSecurityOnline
- Grandoreiro Banking Trojan Evades Defense via Lookalike SoftwareSecurityOnline
- The Shai-Hulud Infiltration: Red Hat Exploited in Sovereign Supply Chain BreachSecurityOnline
- CISA’s KEV Catalog Helps Firms Tackle Oracle WebLogic RiskCISA · official notice
- CISA Puts Oracle WebLogic Flaw CVE‑2024‑21182 on KEV ListCISA · official notice
- CISA flags Oracle WebLogic CVE-2024-21182 as actively exploitedCISA · first in our coverage · official notice