22OCT

WebLogic flaw revived as ransomware vector

4 min read

16:31UTC

CISA listed Oracle WebLogic CVE-2024-21182 on 1 June with a 22 June deadline. Honeypots have caught T3/IIOP exploitation since mid-May delivering Cobalt Strike, miners and Sodinokibi ransomware, despite Oracle patching the bug in January 2024.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A 2024 WebLogic patch nobody confirmed is now delivering Sodinokibi ransomware, with a 22 June federal deadline to remediate.

Oracle WebLogic Server CVE-2024-21182 entered CISA's Known Exploited Vulnerabilities (KEV) catalogue on 1 June 2026, carrying a CVSS 7.5 rating and a 22 June federal deadline⁠¹. WebLogic is the enterprise Java application server embedded across financial, government and large-corporate estates, and the flaw lets an unauthenticated attacker compromise it through its T3 and IIOP protocols, the Java remote-invocation channels WebLogic exposes for application-tier traffic.

Oracle patched the bug in its January 2024 Critical Patch Update, yet honeypots have recorded scans and payloads on ports 7001 and 7002 since mid-May, delivering Cobalt Strike beacons, cryptocurrency miners and Sodinokibi (also known as REvil) ransomware⁠². The 17-month gap between fix and weaponisation is the point: criminal crews reach for the patched estate nobody re-checked, not the freshly disclosed bug.

CISA gave WebLogic 21 days where the Linux and Android entries in the same batch got three, because patching middleware risks application downtime that agencies must schedule rather than rush. The KEV programme has run far tighter on perimeter gear: in May the PAN-OS cutoff landed four days before Oracle's rival Palo Alto shipped its own patch, setting a compliance obligation no remediation could meet. That a patched server now carries ransomware also echoes the FIRESTARTER finding, where a Cisco implant survived every update; in both cases the assumption that a fix ends the exposure is the weak point. WebLogic's deadline at least leaves room to act, but only if the asset inventory reaches the application tier rather than stopping at the edge.

Deep Analysis

In plain English

Oracle WebLogic Server is enterprise middleware software that large companies and government agencies use to run their Java-based business applications. It has a remote-access feature called T3 and IIOP that allows different parts of an application to communicate, but attackers can exploit it to break in without a password. Oracle fixed this particular flaw in January 2024, but many organisations had not yet applied the fix by the time CISA added it to its urgent-action list on 1 June 2026. Honeypot sensors detected attackers scanning for vulnerable servers as early as mid-May, delivering Cobalt Strike (a hacking tool used to maintain access) and Sodinokibi ransomware, which encrypts victims' files and demands payment to restore them.

Deep Analysis

Root Causes

Oracle's quarterly Critical Patch Update cadence, releasing on the third Tuesday of January, April, July and October, creates a predictable 90-day minimum exposure window for any vulnerability discovered between releases. CVE-2024-21182's CVSS 7.5 score placed it below the threshold most enterprise vulnerability-management programmes use to trigger emergency out-of-band patching, meaning it entered the routine quarterly queue and was deprioritised against higher-CVSS items.

WebLogic's T3 and IIOP protocols serve legitimate Java Remote Method Invocation (RMI) traffic in enterprise middleware topologies, making blanket disablement operationally disruptive for large Java EE application estates in financial services and government. That dependency prevents the simple network-layer mitigation that would otherwise neutralise the exposure without a patch.

What could happen next?

Risk
Unpatched WebLogic instances with ports 7001 or 7002 accessible from untrusted networks face near-certain exploitation given honeypot confirmation and Sodinokibi affiliate activity targeting this vector.
Immediate · Assessed
Consequence
The 17-month patch lag on a CVSS 7.5 flaw in critical-infrastructure middleware points to a systematic failure of EPSS-informed prioritisation; organisations should re-evaluate patch-triage thresholds for Java deserialization classes regardless of CVSS score.
Short term · Assessed
Precedent
CISA's KEV listing of a 17-month-old flaw with active Sodinokibi deployment signals willingness to list enterprise middleware CVEs regardless of age when honeypot confirmation emerges, potentially shortening the effective patch-mandate window for future Oracle CPU items.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2020 SolarWinds Orion supply-chain attack involved a 14-month dwell period between the initial compromise and FireEye's December 2020 detection; the WebLogic CVE-2024-21182 exploitation campaign mirrors the same slow-burn dynamic where a patched-but-undeployed fix enables prolonged attacker access.

In the SolarWinds case the gap was between vendor patch and customer awareness; here the gap is between Oracle's January 2024 CPU and operator patching, with mid-May 2026 honeypot scans confirming the window remained open for 17 months.

Counter-parallel: The February 2022 Apache Log4Shell remediation (CVE-2021-44228) saw Oracle ship WebLogic-specific patches within 72 hours and recorded mass enterprise patching within 30 days, demonstrating that WebLogic operators can compress the patch cycle dramatically when vendor communication and executive awareness align.

The CVE-2024-21182 failure to replicate that pace points to a selection effect: critical-severity designations with RCE capability get patched; CVSS 7.5 scores fall below the automatic-escalation threshold in many enterprise patch-prioritisation frameworks.

Sodinokibi (REvil) affiliates operating under a ransomware-as-a-service (RaaS) model claim approximately 20-40 per cent of ransom proceeds; the remainder flows to the core Sodinokibi developers. WebLogic environments are disproportionately concentrated in financial services, insurance, and government sectors: Oracle's own licensing disclosures indicate WebLogic Fusion Middleware accounts for approximately 34 per cent of Oracle middleware revenue, representing hundreds of thousands of production deployments.

Ransom demands in enterprise Java-middleware compromises, based on prior Sodinokibi incidents such as the 2021 JBS Foods attack ($11 million paid) and the 2021 Colonial Pipeline analogous ransomware incident, run between $1 million and $70 million depending on victim size and data sensitivity.

The Cobalt Strike beacon deployed as an intermediate-stage payload enables lateral movement before ransomware deployment, expanding the blast radius beyond the WebLogic server itself to adjacent Active Directory domains and file shares.

Consensus view: Rapid7's Vulnerability Research team and NIST's National Vulnerability Database both document WebLogic's T3 and IIOP protocol exposure as a recurring exploitation surface: CVE-2024-21182 joins a chain of Oracle Java deserialization vulnerabilities (CVE-2020-14882, CVE-2021-2109, CVE-2023-21839) each exploited via the same port-7001 attack path.

The 17-month lag between Oracle's January 2024 patch and CISA's June 2026 KEV listing confirms that enterprise patching of Java middleware follows a fundamentally different, slower cadence than web-tier software.

Counter-view: Russia's FSTEC (Federal Service for Technical and Export Control) argued in a 2024 circular that T3/IIOP protocol disablement, not patching, represents the more durable defence for critical-infrastructure operators, since Oracle's quarterly Critical Patch Update cycle leaves a predictable exploitation window each quarter between patch release and enterprise deployment. Disabling T3 externally via network ACL removes the attack surface regardless of patch status.

Key tension: Whether the EPSS model, which scores CVE-2024-21182 in the 95th percentile for exploitation probability given honeypot confirmation, should trigger CISA KEV listing faster than the 17-month gap recorded here, particularly when Sodinokibi (REvil) affiliates are the confirmed payload deployers.

First Reported In

Update #6 · The 2024 patch that is breaking now

CISA· 7 Jun 2026

Read original →

Causes and effects

Caused by

CISA deadline for PAN-OS RCE lands four days early

The PAN-OS case saw a federal deadline land before the vendor's own patch existed (ID:3122); the WebLogic deadline follows the same KEV-enforcement-ahead-of-remediation pattern, here with a 21-day window rather than negative days.

Occurred 6 May 2026

Read story →

This Event

WebLogic flaw revived as ransomware vector

A server-compromise flaw Oracle fixed two years ago is now an active ransomware entry point, with a 21-day federal deadline reflecting how much harder middleware is to patch than an edge appliance.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.