CVE-2024-21182

Oracle WebLogic Server Unspecified Vulnerability

Oracle — WebLogic Server

Added to KEV catalog: 1 June 2026
Federal remediation due date: 4 June 2026

CISA Description

Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.oracle.com/security-alerts/cpujul2024.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-21182

View on NVD View on MITRE CVE View full CISA catalog

More Oracle Vulnerabilities

CVE-2026-35273

Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability

CVE-2025-61757

Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability

CVE-2025-61884

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

CVE-2025-61882

Oracle E-Business Suite Unspecified Vulnerability

CVE-2024-20953

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services