CVE-2024-21182

What it actually does

CVE-2024-21182 is an unauthenticated information disclosure vulnerability in Oracle WebLogic Server Core affecting supported 12.2.1.4.0 and 14.1.1.0.0 releases. An attacker with network reachability to WebLogic over T3 or IIOP can exploit the flaw without credentials or user interaction to gain unauthorized access to critical data or potentially all data accessible to the WebLogic Server process. The CVSS vector indicates network exploitation, low attack complexity, no privileges required, no integrity or availability impact, and high confidentiality impact.

Why it matters to the business

A successful attack can expose sensitive application data, credentials, session material, configuration details, or business records handled by WebLogic-hosted applications. Because Oracle WebLogic is commonly internet-exposed or reachable from internal application tiers, active exploitation in the wild and CISA KEV listing make this a high-priority remediation item even though the primary impact is data theft rather than service disruption. Organizations subject to regulatory or contractual data-protection obligations may need to assess breach notification, credential rotation, and downstream exposure if exploitation is suspected. CISA lists a remediation due date of 2026-06-04 for covered entities.

How an attack unfolds

An attacker first identifies an Oracle WebLogic Server instance with T3 or IIOP reachable over the network, commonly on WebLogic listen ports such as 7001, 7002, or custom managed-server ports. The attacker determines whether the target is running an affected WebLogic version, then sends crafted protocol traffic over T3 or IIOP to trigger the vulnerable Core component behavior. Because the vulnerability requires no authentication, the attacker does not need valid WebLogic Console, application, or domain credentials. If successful, the server returns or exposes data that should not be accessible to the requester. In an intrusion, that disclosed information may be used directly for data theft or indirectly to support follow-on access, credential abuse, application compromise, or lateral movement. The vulnerability is listed in CISA KEV and has active in-the-wild exploitation, so defenders should assume opportunistic scanning and targeted probing against exposed WebLogic listeners.

How to fix it

Apply the relevant Oracle Critical Patch Update or Security Alert patch that fixes CVE-2024-21182 for Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0. Oracle does not provide a safe configuration-only substitute for applying the vendor fix. If immediate patching is not possible, reduce exposure by blocking untrusted network access to WebLogic T3 and IIOP listener ports, disabling or restricting T3/IIOP where operationally feasible, requiring access through trusted middleware or VPN paths, and enforcing firewall allowlists between application tiers. Review all WebLogic managed servers, admin servers, clusters, container images, golden images, and disaster-recovery instances to ensure the same patch level is applied consistently. After patching, restart affected WebLogic services as required by Oracle guidance and verify that no vulnerable nodes remain in load balancer pools.

How to confirm the fix worked

Confirm the installed Oracle WebLogic Server version and Oracle patch inventory using Oracle OPatch, WebLogic version commands, and domain inventory records. Validate that all affected 12.2.1.4.0 and 14.1.1.0.0 installations have the Oracle CPU patch containing the fix for CVE-2024-21182. From a network perspective, verify that T3 and IIOP are not reachable from untrusted networks and that only approved sources can connect to WebLogic listen ports. Re-run authenticated vulnerability scans or configuration compliance checks after maintenance windows. Confirm that WebLogic AdminServer and all Managed Servers were restarted after patch application and that load balancers are not still routing traffic to unpatched nodes.

Typical attack path

1. Scan for Oracle WebLogic Server endpoints and open T3/IIOP-capable listener ports, commonly TCP 7001, 7002, or organization-specific WebLogic ports.
2. Confirm WebLogic exposure through HTTP headers, WebLogic Console paths, protocol handshakes, error pages, or service banners.
3. Send unauthenticated crafted T3 or IIOP requests to the affected WebLogic Core component.
4. Receive unauthorized sensitive data from the WebLogic Server process or from applications/data sources accessible to it.
5. Use disclosed information for data theft, credential harvesting, session abuse, environment mapping, or follow-on compromise.

How to detect it

Investigate WebLogic AdminServer and Managed Server logs, HTTP access logs, load balancer logs, firewall logs, NetFlow, IDS/IPS telemetry, and packet captures for unauthenticated inbound T3 or IIOP traffic from untrusted sources. Focus on WebLogic listener ports such as 7001, 7002, and any custom application ports. Look for sudden increases in T3/IIOP handshakes, requests from internet scanners, protocol negotiation attempts followed by errors, access to WebLogic endpoints by unfamiliar IPs, and data-transfer patterns inconsistent with normal application behavior. Review logs around periods of vulnerability exposure, especially after public disclosure on 2024-07-16 and during recent spikes in EPSS or scanning activity. Because this is primarily an information disclosure issue, exploitation may not leave obvious file-system artifacts; prioritize network telemetry, WebLogic diagnostic logs, and evidence of unusual data access or follow-on credential use. If suspicious activity is found, preserve WebLogic logs, domain configuration, relevant packet captures, JVM logs, and authentication records for associated applications and data sources.

• T3
• t3 12.
• t3s
• GIOP
• IIOP
• TCP/7001
• TCP/7002
• /console
• /bea_wls_internal
• /wls-wsat
• weblogic.Server
• weblogic.log
• AdminServer.log
• ManagedServer.log
• BEA-000000
• BEA-101020
• BEA-149500

What your security team should do

• Treat this as urgent because it is in CISA KEV, has active exploitation in the wild, and has a high EPSS score of 0.4997.
• Inventory all Oracle WebLogic Server instances, including admin servers, managed servers, clustered nodes, development systems, containerized deployments, and disaster-recovery environments.
• Patch affected WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 installations using the applicable Oracle Critical Patch Update.
• Immediately restrict T3 and IIOP exposure to trusted application tiers and administrative networks only; block internet-originated access wherever possible.
• Hunt for suspicious unauthenticated T3/IIOP traffic, unusual WebLogic errors, abnormal outbound data volume, and access from scanning infrastructure.
• Review whether any sensitive data, credentials, keystores, application configuration, or datasource secrets accessible to WebLogic may have been exposed.
• Rotate credentials and secrets used by WebLogic-hosted applications if exploitation is suspected or confirmed.
• Monitor Oracle advisories and CISA KEV updates for additional exploit details, indicators, or remediation deadlines.