CVE-2024-21182

CVE-2024-21182 is an unauthenticated server-compromise vulnerability in Oracle WebLogic Server, exploitable via the T3 and IIOP Java remote-invocation protocols on ports 7001 and 7002. Oracle patched it in the January 2024 Critical Patch Update, but the flaw's CVSS 7.5 score placed it below most enterprises' emergency-patch thresholds, leaving it in routine quarterly queues. CISA added it to the Known Exploited Vulnerabilities catalogue on 1 June 2026 with a 22 June federal Deadline after honeypots recorded active exploitation from mid-May 2026 delivering Cobalt Strike beacons, Cryptocurrency miners and Sodinokibi ransomware onto compromised WebLogic hosts.

WebLogic's T3 and IIOP channels serve legitimate Java RMI traffic in enterprise middleware stacks, making blanket disablement operationally disruptive for financial-services and government environments that host Java EE applications on WebLogic. That dependency prevented the simple network-layer mitigation that would otherwise neutralise the exposure without a patch, contributing to a 17-month lag between Oracle's fix and active ransomware deployment. Rapid7 documented CVE-2024-21182 as part of a recurring chain through port 7001, following CVE-2020-14882, CVE-2021-2109, and CVE-2023-21839.

The 17-month dwell between patch and weaponisation illustrates the structural pattern the June 2026 KEV batch exposed: the attack surface under pressure is the legacy estate rather than the zero-day frontier. Sodinokibi (REvil) affiliates reached for a confirmed-patched Oracle flaw because enterprise middleware patching follows a slower cadence than web-tier software. The CISA 22 June Deadline, longer than the three days given to the Linux cgroups entry in the same batch, encodes the triage logic: middleware dependencies in regulated sectors earn scheduling grace at the cost of a wider exposure window.