CVE-2024-21182KEV · OVERDUE

Oracle WebLogic Server Unspecified Vulnerability

High · published July 16, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.5th percentile for exploit probability.

142
days past CISA
deadline
CVSS v3.1
7.5
EPSS
74%
Percentile
99.5
In the wild
Confirmed
What it is

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.74162 · 99.5th percentile
Published
2024-07-16T22:40Z
KEV added
2026-06-01 · due 2026-06-04
EPSS history
Timeline
  • 01 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 4
    kev
  • 16 JUL 22:40Z
    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
    cvelistv5