InfoSecBulletin Cybersecurity for mankind
CISA has given a new warning about a serious Oracle WebLogic Server flaw, named CVE-2024-21182, and added it to its Known Exploited Vulnerabilities list on June 1, 2026.
The alert highlights the growing danger from open enterprise middleware systems, especially those that can be accessed through network protocols like T3 and IIOP.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 AirportsÂ
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
The flaw affects Oracle WebLogic Server, a popular application server used for Java in both cloud and on-site settings.
Oracle has not shared all the technical details, but the issue is called an unspecified vulnerability. It can be used from a distance without needing to log in.
Oracle WebLogic Server Vulnerability Exploited
Security researchers say that the way the attack works needs access to the network using WebLogic’s special T3 protocol or the Internet Inter-ORB Protocol (IIOP). These are often used for communication between applications within a company.
Misconfigured WebLogic systems that are exposed to the internet can increase the risk of attacks. This makes them easy targets for hackers looking to get into company networks.
WebLogic has been a common target for ransomware attacks. Cybersecurity experts say that this weakness could be used quickly in money-driven attacks.
The effects of successful exploitation are serious. An attacker can get around security checks and reach important application data, which might allow them to move around inside business systems.
In high-risk situations, this could lead to a complete system takeover, data theft, or the use of extra tools like web shells or remote access trojans.
CISA added CVE-2024-21182 to the KEV catalog, showing it is being used in real attacks. But so far, no specific hackers or ransomware groups are known to be behind these attacks.
Shodan, an internet intelligence platform, now monitors more than 1,592 Oracle WebLogic servers that are online and at risk from CVE-2024-21182 attacks (961 use version 12.2.1.4.0 and 631 use version 14.1.1.0.0).
Organizations using Oracle WebLogic Server must act quickly. CISA has told federal agencies to fix the problem by June 4, 2026, as per Binding Operational Directive 22-01.
The agency says to use Oracle’s official updates or fixes right away. If updates are not ready or can’t be done quickly, companies should think about separating or stopping affected systems to lower risk.
