Oracle WebLogic Server

Oracle WebLogic Server is Oracle's flagship enterprise Java application server, used to run Java EE business applications across financial services, insurance, government and healthcare. It exposes T3 and IIOP protocols — Java Remote Method Invocation channels — to allow application components to communicate across a network, a design that makes it powerful for distributed enterprise systems but creates an exploitable remote-access surface on ports 7001 and 7002.

In June 2026, CISA added CVE-2024-21182 (CVSS 7.5) to its Known Exploited Vulnerabilities catalogue, a flaw patched in Oracle's January 2024 Critical Patch Update that allows unauthenticated server compromise via T3 and IIOP. Honeypots had recorded active scans and payloads on ports 7001 and 7002 since mid-May 2026, delivering Cobalt Strike beacons, Cryptocurrency miners and Sodinokibi (REvil) ransomware. CISA set a 22 June federal Deadline — a 21-day window rather than the three days given to Android and Linux entries in the same batch, reflecting that patching middleware requires scheduled downtime across enterprise application estates.

The CVE-2024-21182 incident continues a documented exploitation chain through WebLogic's T3/IIOP surface. Prior entries include CVE-2020-14882, CVE-2021-2109, and CVE-2023-21839, each weaponised via the same port-7001 pathway. The structural issue is that WebLogic's CVSS 7.5 rating sits below the threshold most enterprise patch-prioritisation frameworks use to trigger emergency patching, meaning it enters quarterly queues and is deprioritised against higher-CVSS items — leaving a 17-month gap between Oracle's fix and the CISA mandate.