Oracle WebLogic vulnerabilities: exploited flaw and latest patch status

Versions 12.2.1.4.0 and 14.1.1.0.0 of "Oracle WebLogic Server"—the business-server software that quietly powers bank core systems, government back offices, and manufacturing production control—carry a flaw that lets attackers read stored data without logging in (CVE-2024-21182), and in June 2026 it was confirmed in use in real attacks. The fix has been included in every quarterly patch since July 2024. WebLogic patches are cumulative—applying the latest one includes all past fixes—so if you have applied the latest quarterly patch (released July 21, 2026), you are already covered for this flaw. The servers at risk are those still on pre-July-2024 patch levels and exposed to the outside.

On June 1, 2026, the US agency CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to remediate by June 4. That deadline has already passed. On top of that, the July 21, 2026 patch also fixed 11 new WebLogic flaws—several of them critical—in one go, making it all the more worthwhile to stay current. This article walks through what the flaw is, whether you are affected, and what to check now, based on information as of July 23, 2026.

The flaw at a glance

First, the key facts. The CVSS score (an international 0–10 severity scale) is 7.5—not the top tier—but on one point the priority for unpatched servers is highest: it has been confirmed in use in real attacks.

"Unauthenticated" means the attack works without logging in. "Information-disclosure" means it does not fully take over the server, but reads the data the server can touch from outside. Even so, banking records or personal data can be read wholesale—not something to take lightly.

When hands reach the foundation through the front door: what gets taken first

What makes this flaw dangerous is that it reaches the contents of a business server directly, slipping past the login wall. The people who put a price on that entry point are initial-access brokers who harvest and resell break-in routes, ransomware crews that extort with stolen data, and nation-state hackers after financial, government, and manufacturing secrets. What they reach for is the very core of an organization: account and transaction records, names and addresses in resident registries, unreleased quarterly results, and production-line design values. The moment CVE-2024-21182 is triggered, the data the server can touch flows out without ever passing the login screen.

Stolen information does not stop at one step. Initial-access brokers sell the read path to ransomware operators for thousands to tens of thousands of dollars, and buyers use that data as a foothold for the next intrusion. Stolen account details and email addresses become tools for convincing fake invoices and partner-impersonation fraud, and one server's fall chains into the takeover of individual customers' and residents' accounts.

The cleanup falls on the IT department that runs the server, and on management. A personal-data breach triggers a duty to report to the Personal Information Protection Commission and notify the individuals, plus explanations to partners, damages, and lost trust. If a financial or government foundation stops, the impact reaches all of society. Whether the patch is in place and the externally open channels are closed is what decides who carries that weight.

What WebLogic actually is

Oracle WebLogic Server is a "Java application server." It keeps an organization's custom business programs (written in Java) running, handles incoming requests, and talks to databases—the "execution foundation." Behind your browser or mobile app, this layer is doing the actual processing.

It is a commercial product from database giant Oracle. In Japan it has been built into financial, public-sector, and large-enterprise core systems through partners such as ITOCHU Techno-Solutions (CTC). Even now that the free Apache Tomcat is widespread, WebLogic remains the choice for core systems that cannot be allowed to stop. Four release lines are current: the newest 15.1.1.0.0 (long-term support) and 14.1.2.0.0, plus 12.2.1.4.0 and 14.1.1.0.0—the two affected by this flaw. All four remain supported with patches available.

In other words, it is a foundation quietly running near-social-infrastructure processing behind flashier services. Precisely because it goes unnoticed, it tends to keep running untouched for a long time—and to an attacker that makes it a high-value target likely to be old and exposed. The June 2026 exploitation confirmed that this target was hunted for real.

Inside CVE-2024-21182: data read via T3 / IIOP

The flaw sits in WebLogic's Core component. Per Rapid7's analysis and NVD (the US vulnerability database), an attacker uses WebLogic's proprietary "T3" and "IIOP" channels to gain unauthorized access to the data the server can touch—no login and no user action required (CVSS vector AV:N/AC:L/PR:N/UI:N, with high confidentiality impact, C:H).

The key here is "T3" and "IIOP." These are channels WebLogic servers and Java clients use to talk internally; they almost never need to be open to the internet. NVD rates the attack complexity as low (AC:L), and allowing these channels to be reachable from outside is itself a danger sign. It is not a full server takeover, but as the "high" confidentiality rating shows, the important data inside can be read wholesale.

Affected are WebLogic Server 12.2.1.4.0 and 14.1.1.0.0; the newer 14.1.2.0.0 and 15.1.1.0.0 are not affected by this particular flaw. The fix shipped in Oracle's July 2024 quarterly patch (Critical Patch Update, CPU). WebLogic CPUs are cumulative, so any CPU applied since then includes this fix.

From the 2024 fix to confirmed exploitation

There is a reason about a year and a half passed between the fix and confirmed exploitation. In December 2024, proof-of-concept (PoC) exploit code was published. With an attack recipe anyone could try in circulation, the bar to hunt down and hit unpatched servers dropped sharply.

Then on June 1, 2026, CISA added the flaw to KEV. KEV lists only vulnerabilities confirmed to have been used in real attacks, so the listing is not a mere advisory—it signals actual exploitation. According to BleepingComputer's report on the addition, external scans at the time found about 1,592 vulnerable WebLogic servers reachable from the internet worldwide (961 on 12.2.1.4.0 and 631 on 14.1.1.0.0). Targeted scanning was reported too, with large volumes of WebLogic-seeking probe traffic observed from a single source.

The timeline so far

← Swipe to move

Update: the July 2026 patch fixed 11 new WebLogic flaws, several of them critical

Separately from CVE-2024-21182, the latest quarterly patch (July 2026 CPU), released July 21, 2026, fixed 11 new WebLogic Server flaws. They affect all four current release lines: 12.2.1.4.0 and 14.1.1.0.0, plus the newer 14.1.2.0.0 and 15.1.1.0.0. Note that "we're on a new version, so we're safe" no longer holds.

CVE-2026-60206: full server takeover without login

The most severe of the 11 is CVE-2026-60206 (CVSS 9.9). Where CVE-2024-21182 was "read only," this one leads to a complete takeover of the server without login, and researchers warn a compromised server can be used as a springboard into other products.

CVE-2026-60198 and others: multiple 9.8-rated unauthenticated flaws

Alongside it sit CVE-2026-60198 / 60202 / 60204 / 60205 and others rated CVSS 9.8. All work without login, and beyond T3 and IIOP they can also be reached via HTTP or SOAP (a web-service protocol). They are "deserialization" flaws—the server is tricked while reassembling data sent from outside, ending up executing the attacker's instructions. This is the same family of hole that WebLogic has been attacked through repeatedly over the years.

The good news: as of July 23, 2026, no real-world exploitation or public exploit code has been confirmed for these new flaws, and none is on KEV. Past experience says attacks on this type of WebLogic flaw tend to start soon after a patch ships, though. Since patches are cumulative, applying the July 2026 CPU closes both CVE-2024-21182 and all 11 new flaws at once. Before attacks begin is the cheapest time to act.

What IT departments should check now

The top priority is applying the latest quarterly patch (the July 2026 CPU). Being cumulative, it includes both the fix for the confirmed-exploited CVE-2024-21182 and the fixes for the 11 new flaws. At minimum, any server still on a pre-July-2024 patch level remains exposed to a flaw used in real attacks—update it immediately. If you cannot patch right away, restrict T3 and IIOP traffic to internal sources only via the firewall as a stopgap; these channels need not be open to the internet. Keep in mind, though, that some of the new July flaws are reachable over HTTP, so blocking is only buying time.

Since exploitation of CVE-2024-21182 is confirmed, checking for signs of an existing intrusion is essential. Review access logs and look for T3 or IIOP traffic from unfamiliar sources. If you do not run it directly but outsource to an SIer or cloud provider, asking about their response is the fastest route—confirm their patch schedule and, if needed, apply network-side access restrictions on your side.

Note that the other leading business server, IBM WebSphere, has also disclosed a string of critical flaws in 2026. If you run both, also review the WebSphere critical flaws roundup. To track major vulnerabilities affecting widely used products in Japan, the KEV dashboard for tracking confirmed-exploited flaws and the 2026 first-half roundup of major vulnerabilities are useful.

FAQ

Summary

Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 carry CVE-2024-21182, a flaw that lets attackers read server data without logging in. The fix shipped in July 2024, but unpatched servers remained, and in June 2026 CISA confirmed real-world exploitation and added it to KEV. Patches are cumulative, so if you have applied the latest quarterly patch (the July 2026 CPU, released July 21, 2026), both this flaw and the 11 new flaws fixed alongside it are closed. As of July 23, 2026, no exploitation of the new flaws has been confirmed, but WebLogic is a product where the same family of flaw has been hunted again and again. Use this moment to take stock of your WebLogic version, patch status, and any externally open T3, IIOP, or HTTP channels.

References

• ▸NVD - CVE-2024-21182 (Oracle WebLogic Server)
• ▸Rapid7 - Oracle WebLogic CVE-2024-21182
• ▸Oracle - Critical Patch Update Advisory (July 2024)
• ▸Oracle - Critical Patch Update Advisory (July 2026)
• ▸SecurityOnline - PoC Exploit Code Published for CVE-2024-21182
• ▸BleepingComputer - CISA orders feds to patch actively exploited Oracle WebLogic flaw
• ▸SecurityWeek - Oracle WebLogic Vulnerability Exploited in the Wild
• ▸SecurityOnline - Oracle WebLogic Server Vulnerability CVE-2026-60206
• ▸CyCognito - Oracle WebLogic Server Multiple Critical RCE Vulnerabilities (July 2026 CPU)
• ▸Oracle - Announcing WebLogic Server and Coherence 15.1.1
• ▸CISA - Known Exploited Vulnerabilities Catalog