# Oracle WebLogic Server CVE-2024-21182 — Unauthenticated T3/IIOP Unspecified Vulnerability Added to CISA KEV on Active-Exploitation Evidence

> CISA added Oracle WebLogic Server vulnerability CVE-2024-21182 to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-06-01 based on evidence of active exploitation, with a BOD 22-01 remediation due date of 2026-06-04. The flaw lets an unauthenticated attacker with network access via the T3 or IIOP protocols compromise WebLogic Server and obtain unauthorized access to all server-accessible data; public proof-of-concept exploit code characterizing it as a JNDI vulnerability has been available since December 2024.

- **Published:** 2026-06-01T00:00:00Z
- **Last reviewed:** 2026-06-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0649
- **ID:** TL-2026-0649
- **Severity:** CRITICAL (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-21182, CVE-2023-21839

## Description

CVE-2024-21182 is an easily exploitable vulnerability in the Core component of Oracle WebLogic Server (part of Oracle Fusion Middleware). It allows an unauthenticated attacker with network access over the T3 or IIOP protocols to compromise the server, resulting in unauthorized access to critical data or complete access to all WebLogic Server-accessible data. Oracle assigned a CVSS 3.1 base score of 7.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — a confidentiality-only impact reflecting unauthorized read access. The vulnerability was patched in the Oracle July 2024 Critical Patch Update; affected supported versions are 12.2.1.4.0 and 14.1.1.0.0. NVD records the weakness as CWE-noinfo (insufficient information).

Oracle's advisory classifies the issue as 'unspecified,' but the public proof-of-concept published by GitHub user k4it0k1d (CVE_2024_21182.java, written in Java) explicitly labels it an 'Oracle WebLogic Server JNDI Vulnerability.' This places CVE-2024-21182 squarely in the well-documented WebLogic T3/IIOP JNDI-injection / post-deserialization lineage that includes CVE-2020-2883 and CVE-2023-21839. In that class of bug, an unauthenticated attacker abuses the T3 or IIOP remote protocols to trigger a server-side JNDI lookup (historically via classes such as ForeignOpaqueReference's getReferent()). When a vulnerable JDK or available deserialization gadget chain is present on the server, JNDI-driven abuse of this family has repeatedly escalated from unauthorized data access to full remote code execution. Defenders should therefore treat exploitation of CVE-2024-21182 as potentially leading to code execution and full server takeover, even though Oracle's CVSS scoring captures only the confidentiality impact.

Internet-facing WebLogic Servers (default port 7001) are a perennial target. The broader WebLogic T3/IIOP exploitation ecosystem is dominated by financially motivated cryptojacking crews — most notably the 8220 Gang (a.k.a. Water Sigbin) — which has chained older WebLogic flaws (CVE-2017-3506, CVE-2017-10271, CVE-2023-21839) to deploy XMRig/PwnRig miners, the k4spreader installer, the Tsunami DDoS bot, and PureCrypter loaders, often using fileless reflective-DLL and process-injection techniques and killing rival botnets such as Kinsing. With a public PoC available and a CISA KEV active-exploitation designation, CVE-2024-21182 is expected to be folded into these opportunistic mass-scanning and exploitation campaigns. CISA's KEV entry records the known ransomware campaign use as 'Unknown.'

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1053 Scheduled Task/Job
- T1068 Exploitation for Privilege Escalation
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1496 Resource Hijacking

## Sources

- [NVD — CVE-2024-21182 Detail](https://nvd.nist.gov/vuln/detail/CVE-2024-21182)
- [Oracle Critical Patch Update Advisory — July 2024](https://www.oracle.com/security-alerts/cpujul2024.html)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/01/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2024-21182](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21182)
- [Public PoC — k4it0k1d/CVE-2024-21182 (Oracle WebLogic Server JNDI Vulnerability)](https://github.com/k4it0k1d/CVE-2024-21182)
- [CVE-2024-21182: Oracle WebLogic Server Flaw Exploit Code Released](https://thecyberthrone.in/2024/12/31/cve-2024-21182-oracle-weblogic-server-flaw-exploit-code-released/)
- [Oracle WebLogic: CVE-2024-21182 (Rapid7 Vulnerability DB)](https://www.rapid7.com/db/vulnerabilities/oracle-weblogic-cve-2024-21182/)
- [WebLogic Deserialization Vulnerability — CVE-2023-21839 (lineage / mechanism reference)](https://attackerkb.com/topics/5iej3M43gQ/cve-2023-21839)
- [8220 Gang Exploits Oracle WebLogic Server Flaws for Cryptocurrency Mining](https://thehackernews.com/2024/06/8220-gang-exploits-oracle-weblogic.html)
- [A Post-exploitation Look at Coinminers Abusing WebLogic Vulnerabilities (Trend Micro)](https://www.trendmicro.com/en_us/research/22/i/a-post-exploitation-look-at-coinminers-abusing-weblogic-vulnerab.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0649