CISA orders federal patch of Oracle WebLogic CVE-2024-21182

The U.S. Cybersecurity and Infrastructure Security Agency has ordered federal agencies to urgently patch a two-year-old vulnerability in Oracle WebLogic Server, warning that the flaw is now being actively exploited. The agency added the vulnerability, tracked as CVE-2024-21182, to its Known Exploited Vulnerabilities catalog on June 1, giving federal entities a deadline of June 4 to apply the fix.

The vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. According to Oracle's original advisory, the flaw is easily exploitable and allows an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise the server. Successful attacks can result in unauthorized access to critical data or complete access to all accessible data on the server.

While the binding directive applies to federal agencies, officials urged all organizations, including those in the private sector, to patch their systems immediately. A CISA spokesperson stated that inclusion in the catalog means the agency has confirmed the vulnerability is being exploited in the wild. Security experts agreed, noting that the listing signifies active attacks are occurring.