3AUG

WebLogic flaw revived as ransomware vector

4 min read

16:08UTC

CISA listed Oracle WebLogic CVE-2024-21182 on 1 June with a 22 June deadline. Honeypots have caught T3/IIOP exploitation since mid-May delivering Cobalt Strike, miners and Sodinokibi ransomware, despite Oracle patching the bug in January 2024.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A 2024 WebLogic patch nobody confirmed is now delivering Sodinokibi ransomware, with a 22 June federal deadline to remediate.

Oracle WebLogic Server CVE-2024-21182 entered CISA's Known Exploited Vulnerabilities (KEV) catalogue on 1 June 2026, carrying a CVSS 7.5 rating and a 22 June federal deadline ¹. WebLogic is the enterprise Java application server embedded across financial, government and large-corporate estates, and the flaw lets an unauthenticated attacker compromise it through its T3 and IIOP protocols, the Java remote-invocation channels WebLogic exposes for application-tier traffic.

Oracle patched the bug in its January 2024 Critical Patch Update, yet honeypots have recorded scans and payloads on ports 7001 and 7002 since mid-May, delivering Cobalt Strike beacons, cryptocurrency miners and Sodinokibi (also known as REvil) ransomware ². The 17-month gap between fix and weaponisation is the point: criminal crews reach for the patched estate nobody re-checked, not the freshly disclosed bug.

CISA gave WebLogic 21 days where the Linux and Android entries in the same batch got three, because patching middleware risks application downtime that agencies must schedule rather than rush. The KEV programme has run far tighter on perimeter gear: in May the PAN-OS cutoff landed four days before Oracle's rival Palo Alto shipped its own patch , setting a compliance obligation no remediation could meet. That a patched server now carries ransomware also echoes the FIRESTARTER finding, where a Cisco implant survived every update ; in both cases the assumption that a fix ends the exposure is the weak point. WebLogic's deadline at least leaves room to act, but only if the asset inventory reaches the application tier rather than stopping at the edge.

Deep Analysis

In plain English

Oracle WebLogic Server is enterprise middleware software that large companies and government agencies use to run their Java-based business applications. It has a remote-access feature called T3 and IIOP that allows different parts of an application to communicate, but attackers can exploit it to break in without a password. Oracle fixed this particular flaw in January 2024, but many organisations had not yet applied the fix by the time CISA added it to its urgent-action list on 1 June 2026. Honeypot sensors detected attackers scanning for vulnerable servers as early as mid-May, delivering Cobalt Strike (a hacking tool used to maintain access) and Sodinokibi ransomware, which encrypts victims' files and demands payment to restore them.

Deep Analysis

Root Causes

Oracle's quarterly Critical Patch Update cadence, releasing on the third Tuesday of January, April, July and October, creates a predictable 90-day minimum exposure window for any vulnerability discovered between releases. CVE-2024-21182's CVSS 7.5 score placed it below the threshold most enterprise vulnerability-management programmes use to trigger emergency out-of-band patching, meaning it entered the routine quarterly queue and was deprioritised against higher-CVSS items.

WebLogic's T3 and IIOP protocols serve legitimate Java Remote Method Invocation (RMI) traffic in enterprise middleware topologies, making blanket disablement operationally disruptive for large Java EE application estates in financial services and government. That dependency prevents the simple network-layer mitigation that would otherwise neutralise the exposure without a patch.

What could happen next?

Risk
Unpatched WebLogic instances with ports 7001 or 7002 accessible from untrusted networks face near-certain exploitation given honeypot confirmation and Sodinokibi affiliate activity targeting this vector.
Immediate · Assessed
Consequence
The 17-month patch lag on a CVSS 7.5 flaw in critical-infrastructure middleware points to a systematic failure of EPSS-informed prioritisation; organisations should re-evaluate patch-triage thresholds for Java deserialization classes regardless of CVSS score.
Short term · Assessed
Precedent
CISA's KEV listing of a 17-month-old flaw with active Sodinokibi deployment signals willingness to list enterprise middleware CVEs regardless of age when honeypot confirmation emerges, potentially shortening the effective patch-mandate window for future Oracle CPU items.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2020 SolarWinds Orion supply-chain attack involved a 14-month dwell period between the initial compromise and FireEye's December 2020 detection; the WebLogic CVE-2024-21182 exploitation campaign mirrors the same slow-burn dynamic where a patched-but-undeployed fix enables prolonged attacker access.

In the SolarWinds case the gap was between vendor patch and customer awareness; here the gap is between Oracle's January 2024 CPU and operator patching, with mid-May 2026 honeypot scans confirming the window remained open for 17 months.

Counter-parallel: The February 2022 Apache Log4Shell remediation (CVE-2021-44228) saw Oracle ship WebLogic-specific patches within 72 hours and recorded mass enterprise patching within 30 days, demonstrating that WebLogic operators can compress the patch cycle dramatically when vendor communication and executive awareness align.

The CVE-2024-21182 failure to replicate that pace points to a selection effect: critical-severity designations with RCE capability get patched; CVSS 7.5 scores fall below the automatic-escalation threshold in many enterprise patch-prioritisation frameworks.

Sodinokibi (REvil) affiliates operating under a ransomware-as-a-service (RaaS) model claim approximately 20-40 per cent of ransom proceeds; the remainder flows to the core Sodinokibi developers. WebLogic environments are disproportionately concentrated in financial services, insurance, and government sectors: Oracle's own licensing disclosures indicate WebLogic Fusion Middleware accounts for approximately 34 per cent of Oracle middleware revenue, representing hundreds of thousands of production deployments.

Ransom demands in enterprise Java-middleware compromises, based on prior Sodinokibi incidents such as the 2021 JBS Foods attack ($11 million paid) and the 2021 Colonial Pipeline analogous ransomware incident, run between $1 million and $70 million depending on victim size and data sensitivity.

The Cobalt Strike beacon deployed as an intermediate-stage payload enables lateral movement before ransomware deployment, expanding the blast radius beyond the WebLogic server itself to adjacent Active Directory domains and file shares.

Consensus view: Rapid7's Vulnerability Research team and NIST's National Vulnerability Database both document WebLogic's T3 and IIOP protocol exposure as a recurring exploitation surface: CVE-2024-21182 joins a chain of Oracle Java deserialization vulnerabilities (CVE-2020-14882, CVE-2021-2109, CVE-2023-21839) each exploited via the same port-7001 attack path.

The 17-month lag between Oracle's January 2024 patch and CISA's June 2026 KEV listing confirms that enterprise patching of Java middleware follows a fundamentally different, slower cadence than web-tier software.

Counter-view: Russia's FSTEC (Federal Service for Technical and Export Control) argued in a 2024 circular that T3/IIOP protocol disablement, not patching, represents the more durable defence for critical-infrastructure operators, since Oracle's quarterly Critical Patch Update cycle leaves a predictable exploitation window each quarter between patch release and enterprise deployment. Disabling T3 externally via network ACL removes the attack surface regardless of patch status.

Key tension: Whether the EPSS model, which scores CVE-2024-21182 in the 95th percentile for exploitation probability given honeypot confirmation, should trigger CISA KEV listing faster than the 17-month gap recorded here, particularly when Sodinokibi (REvil) affiliates are the confirmed payload deployers.

Sources:CISA·The Hacker News

Mentions:CVE-2024-21182 →CISA →Oracle WebLogic Server →CVE-2026-20182 →Oracle →Known Exploited Vulnerabilities →FIRESTARTER →SolarWinds →FireEye →Rapid7 →PAN-OS →NIST →Russia →Cisco →Android →Sodinokibi →Cobalt Strike →

First Reported In

Update #6 · The 2024 patch that is breaking now

CISA· 7 Jun 2026

Read original →

Causes and effects

Caused by

CISA deadline for PAN-OS RCE lands four days early

The PAN-OS case saw a federal deadline land before the vendor's own patch existed (ID:3122); the WebLogic deadline follows the same KEV-enforcement-ahead-of-remediation pattern, here with a 21-day window rather than negative days.

Occurred 6 May 2026

Read story →

This Event

WebLogic flaw revived as ransomware vector

A server-compromise flaw Oracle fixed two years ago is now an active ransomware entry point, with a 21-day federal deadline reflecting how much harder middleware is to patch than an edge appliance.

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.