Cyber Resilience

CVE-2024-21182

Oracle Weblogic Server 12.2.1.4.0 … 14.1.1.0.0

CISA KEVActive Exploitation
Published
16 July 2024
Modified
01 June 2026
KEV Added
01 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.50 99th percentile
Risk Priority 84 floored blend · peak EPSS

Summary

CVE-2024-21182 is a high-severity an unspecified weakness vulnerability in Oracle Weblogic Server. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-21182 is a vulnerability in the Core component of Oracle WebLogic Server within Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.1.0.0 and carries a CVSS 3.1 base score of 7.5 with a vector indicating network attack vector, low attack complexity, no required privileges or user interaction, and high confidentiality impact.

An unauthenticated attacker with network access via the T3 or IIOP protocols can exploit the flaw to obtain unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

The vulnerability is covered in the Oracle Critical Patch Update for July 2024. It is also listed in CISA's Known Exploited Vulnerabilities catalog.

The associated EPSS score is currently 0.8974, matching its recorded peak.

EU & UK References

Vulnerability Data

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful…

more

attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE(s)
NVD-CWE-noinfo
KEV Date Added
01 June 2026

Related Threats

CVEs Like This One

CVE-2023-21839Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14882Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-2551Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14750Same product: Oracle Weblogic Serverboth on KEV
CVE-2018-2628Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-2883Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14644Same product: Oracle Weblogic Serverboth on KEV
CVE-2020-14883Same product: Oracle Weblogic Serverboth on KEV
CVE-2017-3506Same product: Oracle Weblogic Serverboth on KEV
CVE-2017-10271Same product: Oracle Weblogic Serverboth on KEV

Affected Assets

oracle
weblogic server
12.2.1.4.0, 14.1.1.0.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References