The Cybersecurity and Infrastructure Security Agency added CVE-2024-21182, a critical vulnerability in Oracle WebLogic Server, to its Known Exploited Vulnerabilities catalog on June 1, 2026, confirming active exploitation in the wild. The vulnerability allows unauthenticated attackers with network access via the T3 or IIOP protocols to compromise WebLogic Server instances, potentially gaining unauthorized access to critical data or complete access to all accessible data.
Federal Civilian Executive Branch agencies face a remediation deadline of June 4, 2026 — just three days from the catalog addition — reflecting the severity and urgency of the threat. The vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, which are widely deployed across enterprise environments for Java application hosting.
While this CVE was originally disclosed in 2024, its addition to the KEV catalog now signals that threat actors have begun actively exploiting unpatched instances. CISA strongly urges all organizations, including private sector entities, to prioritize remediation.
Sources
Commentary
This is a prime example of the “long tail of unpatched vulnerabilities” problem. CVE-2024-21182 was disclosed two years ago, yet here we are in 2026 with active exploitation forcing CISA to issue an emergency catalog addition with a three-day remediation deadline. Oracle WebLogic is deeply embedded in enterprise infrastructure — financial services, telecommunications, government — and the T3/IIOP attack vectors make any internet-exposed instance a sitting duck.
The compressed remediation timeline tells you how serious this is. If your organization runs WebLogic and hasn’t patched, the time to act was 2024. The next best time is right now. Given the Verizon 2026 DBIR finding that 31% of breaches now originate from software vulnerabilities, stories like this will only become more common as attackers systematically harvest the backlog of unpatched CVEs.