Threat reportVulnerabilityTL-2026-0649
Oracle WebLogic Server CVE-2024-21182 — Unauthenticated T3/IIOP Unspecified Vulnerability Added to CISA KEV on Active-Exploitation Evidence
Oracle WebLogic Server CVE-2024-21182 (TL-2026-0649) is a critical-severity software vulnerability scored CVSS 7.5, first published 2026-06-01. It has no confirmed attribution, affects Oracle WebLogic Server (Oracle Fusion Middleware) — Core component, references 2 CVEs (CVE-2024-21182, CVE-2023-21839), maps to 15 MITRE ATT&CK techniques (T1053, T1055, T1059), and is covered by 9 detection rules and 22 indicators of compromise.
- CVSS
- 7.5/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-0649
- Threat ID
- TL-2026-0649
- Severity
- CRITICAL
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- government, financial, technology, telecommunications, manufacturing, healthcare, education, retail
- Target regions
- North America, Europe, Asia, Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Oracle WebLogic Server CVE-2024-21182
Malware and tooling: Kinsing, PureCrypter, PwnRig, k4spreader, tsunami, xmrig
How Oracle WebLogic Server CVE-2024-21182 works
CISA added Oracle WebLogic Server vulnerability CVE-2024-21182 to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-06-01 based on evidence of active exploitation, with a BOD 22-01 remediation due date of 2026-06-04. The flaw lets an unauthenticated attacker with network access via the T3 or IIOP protocols compromise WebLogic Server and obtain unauthorized access to all server-accessible data; public proof-of-concept exploit code characterizing it as a JNDI vulnerability has been available since December 2024.
CVE-2024-21182 is an easily exploitable vulnerability in the Core component of Oracle WebLogic Server (part of Oracle Fusion Middleware). It allows an unauthenticated attacker with network access over the T3 or IIOP protocols to compromise the server, resulting in unauthorized access to critical data or complete access to all WebLogic Server-accessible data. Oracle assigned a CVSS 3.1 base score of 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — a confidentiality-only impact reflecting unauthorized read access. The vulnerability was patched in the Oracle July 2024 Critical Patch Update; affected supported versions are 12.2.1.4.0 and 14.1.1.0.0. NVD records the weakness as CWE-noinfo (insufficient information).
Oracle's advisory classifies the issue as 'unspecified,' but the public proof-of-concept published by GitHub user k4it0k1d (CVE_2024_21182.java, written in Java) explicitly labels it an 'Oracle WebLogic Server JNDI Vulnerability.' This places CVE-2024-21182 squarely in the well-documented WebLogic T3/IIOP JNDI-injection / post-deserialization lineage that includes CVE-2020-2883 and CVE-2023-21839. In that class of bug, an unauthenticated attacker abuses the T3 or IIOP remote protocols to trigger a server-side JNDI lookup (historically via classes such as ForeignOpaqueReference's getReferent()). When a vulnerable JDK or available deserialization gadget chain is present on the server, JNDI-driven abuse of this family has repeatedly escalated from unauthorized data access to full remote code execution. Defenders should therefore treat exploitation of CVE-2024-21182 as potentially leading to code execution and full server takeover, even though Oracle's CVSS scoring captures only the confidentiality impact.
Internet-facing WebLogic Servers (default port 7001) are a perennial target. The broader WebLogic T3/IIOP exploitation ecosystem is dominated by financially motivated cryptojacking crews — most notably the 8220 Gang (a.k.a. Water Sigbin) — which has chained older WebLogic flaws (CVE-2017-3506, CVE-2017-10271, CVE-2023-21839) to deploy XMRig/PwnRig miners, the k4spreader installer, the Tsunami DDoS bot, and PureCrypter loaders, often using fileless reflective-DLL and process-injection techniques and killing rival botnets such as Kinsing. With a public PoC available and a CISA KEV active-exploitation designation, CVE-2024-21182 is expected to be folded into these opportunistic mass-scanning and exploitation campaigns. CISA's KEV entry records the known ransomware campaign use as 'Unknown.'
MITRE ATT&CK techniques used in TL-2026-0649
Persistence
T1053 Scheduled Task/Job; T1505 Server Software Component
Defense Evasion
T1055 Process Injection; T1620 Reflective Code Loading
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
Credential Access
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
defense-impairment
Affected products and versions in Oracle WebLogic Server CVE-2024-21182
- Oracle — WebLogic Server (Oracle Fusion Middleware) — Core component
Vulnerable versions: 12.2.1.4.0; 14.1.1.0.0
Fixed in: Patched in Oracle Critical Patch Update July 2024
Remediation for Oracle WebLogic Server CVE-2024-21182
Patches
- Oracle Critical Patch Update July 2024 (https://www.oracle.com/security-alerts/cpujul2024.html)
Immediate actions
- Apply the Oracle July 2024 Critical Patch Update (CPU) to WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 — CISA BOD 22-01 due date is 2026-06-04
- Restrict or block external access to the WebLogic T3/IIOP listen port (default TCP 7001) at the network perimeter
- Enable and configure a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allowlist only trusted source IPs for T3 and IIOP
Workarounds
- Disable T3/IIOP via WebLogic console (Protocols configuration)
- Apply connection filter rules to deny T3/IIOP from untrusted networks
- Front WebLogic with a WAF/reverse proxy that does not forward raw T3/IIOP
Longer-term hardening
- Disable the T3 and IIOP protocols entirely where not required for application functionality
- Place WebLogic admin and internal protocol interfaces behind network segmentation and VPN; never expose 7001 to the internet
- Deploy EDR with behavioral detection for Java/WebLogic processes spawning command interpreters and for cryptominer execution
- Decommission or isolate unsupported/unpatched WebLogic instances
CVEs associated with Oracle WebLogic Server CVE-2024-21182
Weaknesses (CWE) in Oracle WebLogic Server CVE-2024-21182
Timeline of Oracle WebLogic Server CVE-2024-21182
- NVD publishes CVE-2024-21182 detailing unauthenticated T3/IIOP network access to the WebLogic Core component; weakness recorded as CWE-noinfo.
- Oracle discloses and patches CVE-2024-21182 in the July 2024 Critical Patch Update; assigns CVSS 3.1 base score 7.5 (C:H/I:N/A:N) affecting WebLogic Server 12.2.1.4.0 and 14.1.1.0.0.
- Public proof-of-concept exploit (CVE_2024_21182.java) published to GitHub by user k4it0k1d, characterizing the flaw as an 'Oracle WebLogic Server JNDI Vulnerability.'
- Security press (TheCyberThrone, SecurityOnline) reports public exploit code is available, raising mass-exploitation risk for internet-exposed WebLogic instances.
- CISA adds CVE-2024-21182 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.06.01) citing evidence of active exploitation; ransomware campaign use listed as 'Unknown.'
- CISA BOD 22-01 remediation due date for federal civilian agencies to apply mitigations or discontinue use of the product.
Sources cited for Oracle WebLogic Server CVE-2024-21182
- NVD — CVE-2024-21182 Detail
- Oracle Critical Patch Update Advisory — July 2024
- CISA Adds One Known Exploited Vulnerability to Catalog
- CISA Known Exploited Vulnerabilities Catalog — CVE-2024-21182
- Public PoC — k4it0k1d/CVE-2024-21182 (Oracle WebLogic Server JNDI Vulnerability)
- CVE-2024-21182: Oracle WebLogic Server Flaw Exploit Code Released
- Oracle WebLogic: CVE-2024-21182 (Rapid7 Vulnerability DB)
- WebLogic Deserialization Vulnerability — CVE-2023-21839 (lineage / mechanism reference)
- 8220 Gang Exploits Oracle WebLogic Server Flaws for Cryptocurrency Mining
- A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities (Trend Micro)
Detection coverage for TL-2026-0649
As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0649 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.