Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware

CVE-2024-21182 is a pre-auth Oracle WebLogic Server flaw in the Core component that lets an unauthenticated attacker with network reachability over T3 or IIOP pull sensitive data from the server. Oracle lists affected versions as 12.2.1.4.0 and 14.1.1.0.0; the July 2024 CPU addressed it, with the 12c track publicly showing WLS STACK PATCH BUNDLE 12.2.1.4.240710 / WLS PATCH SET UPDATE 12.2.1.4.240704 as the relevant fixed train.

Oracle's 7.5/HIGH baseline is directionally right on technical impact, but reality is harsher because this is now KEV-listed with active exploitation and public PoC. The counterweight is real too: this is not generic HTTP reachability; the attacker needs exposure to WebLogic's T3/IIOP path, which materially narrows the reachable population in mature enterprises. Net: this stays HIGH, upgraded in urgency, not in bucket.

Why this verdict

• Vendor baseline starts at 7.5/HIGH because this is unauthenticated, remote, low-complexity access to sensitive data.
• KEV + public PoC push the score up: this moved from theoretical to operational, and defenders should assume opportunistic scanning is already happening.
• Reachability friction keeps it below CRITICAL: the attacker needs T3/IIOP access, which implies a smaller exposed population than generic web flaws and often means post-initial-access east-west exploitation in modern enterprises.
• Impact is serious but not full-spectrum: Oracle scored confidentiality high, but integrity and availability are not part of the demonstrated baseline, so this is not the same class as unauthenticated WebLogic RCE.

Why not higher?

I am not calling this CRITICAL because the exploit path is not simple HTTPS to a login page; it depends on T3/IIOP reachability, which many mature environments intentionally suppress. Also, the published severity basis is unauthorized data access, not proven turnkey RCE with broad host takeover.

Why not lower?

I am not downgrading it because KEV trumps wishful thinking. A pre-auth Oracle WebLogic bug with public PoC and confirmed in-the-wild use is exactly the kind of issue that burns defenders who over-index on protocol friction.

1. Block T3 and IIOP from untrusted networks — Put ACLs, security groups, or NGFW rules in front of every WebLogic listener and allow only known app peers. Because this is KEV-listed and actively exploited, deploy this immediately, within hours.
2. Disable unused remoting protocols — If the application does not require T3, T3S, or IIOP, turn them off or remove public/internal channels that expose them. This is the cleanest blast-radius reduction and should also be done immediately, within hours.
3. Constrain WebLogic network channels — Bind admin and remoting channels to management VLANs or loopback/proxy-only interfaces rather than broad server subnets. If patching cannot happen same-day, enforce this segmentation immediately, within hours.
4. Audit service-account reach — Reduce database and backend privileges available to the WebLogic runtime so a successful exploit yields less data. Treat this as short-term containment and complete it within hours to 1 day for exposed systems.
5. Hunt for abnormal T3/IIOP traffic and data access — Look for new peers touching WebLogic remoting ports, unusual JDBC activity, and suspicious reads by middleware service accounts. Start the hunt immediately, within hours, because KEV means you may already be behind.

Run this on the target WebLogic host as the same OS account that owns the Oracle home, or as root with read access to the Oracle installation. Invoke it like ./check_cve_2024_21182.sh /u01/app/oracle/middleware or point it directly at ORACLE_HOME; it needs local filesystem access and, if present, will use OPatch to verify whether a July 2024-or-later WLS bundle was applied.

#!/usr/bin/env bash
# check_cve_2024_21182.sh
# Detect likely exposure to CVE-2024-21182 on Oracle WebLogic Server.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <ORACLE_HOME|MIDDLEWARE_HOME>"
  exit 3
fi

if [[ ! -d "$TARGET" ]]; then
  echo "UNKNOWN - path does not exist: $TARGET"
  exit 2
fi

ORACLE_HOME=""
if [[ -x "$TARGET/OPatch/opatch" ]]; then
  ORACLE_HOME="$TARGET"
elif [[ -d "$TARGET/oracle_common" && -x "$TARGET/OPatch/opatch" ]]; then
  ORACLE_HOME="$TARGET"
else
  # Try to discover a child Oracle home with OPatch
  CANDIDATE=$(find "$TARGET" -maxdepth 3 -type f -path '*/OPatch/opatch' 2>/dev/null | head -n 1)
  if [[ -n "$CANDIDATE" ]]; then
    ORACLE_HOME=$(dirname "$(dirname "$CANDIDATE")")
  fi
fi

if [[ -z "$ORACLE_HOME" ]]; then
  echo "UNKNOWN - could not locate ORACLE_HOME with OPatch under: $TARGET"
  exit 2
fi

VERSION=""
REG1="$ORACLE_HOME/inventory/registry.xml"
REG2="$ORACLE_HOME/oui/registry.xml"
for REG in "$REG1" "$REG2"; do
  if [[ -f "$REG" ]]; then
    VERSION=$(grep -Eo 'version="(12\.2\.1\.4\.0|14\.1\.1\.0\.0)"' "$REG" | head -n 1 | cut -d'"' -f2)
    [[ -n "$VERSION" ]] && break
  fi
done

if [[ -z "$VERSION" ]]; then
  # Fallback: search common files
  VERSION=$(grep -R -Eo '12\.2\.1\.4\.0|14\.1\.1\.0\.0' "$ORACLE_HOME"/registry* "$ORACLE_HOME"/inventory* "$ORACLE_HOME"/oracle_common 2>/dev/null | head -n 1 || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not determine WebLogic version under $ORACLE_HOME"
  exit 2
fi

if [[ "$VERSION" != "12.2.1.4.0" && "$VERSION" != "14.1.1.0.0" ]]; then
  echo "PATCHED - installed version $VERSION is not in the affected set for CVE-2024-21182"
  exit 0
fi

OPATCH="$ORACLE_HOME/OPatch/opatch"
if [[ ! -x "$OPATCH" ]]; then
  echo "UNKNOWN - affected base version $VERSION found, but OPatch is unavailable"
  exit 2
fi

INV=$($OPATCH lsinventory 2>/dev/null)
if [[ -z "$INV" ]]; then
  echo "UNKNOWN - affected base version $VERSION found, but could not read OPatch inventory"
  exit 2
fi

# Heuristics for July 2024-or-later WLS bundles.
# 12.2.1.4 public train includes SPB 12.2.1.4.240710 / PSU 12.2.1.4.240704.
# 14.1.1.0.0 requires July 2024 CPU-or-later cumulative WLS patch; we look for 2407xx+ bundle/PSU naming.
if [[ "$VERSION" == "12.2.1.4.0" ]]; then
  if echo "$INV" | grep -Eq '12\.2\.1\.4\.(240710|2407[1-9][0-9]|240[89][0-9]{2}|24(10|11|12)[0-9]{2}|25[0-9]{4}|26[0-9]{4})|WLS PATCH SET UPDATE 12\.2\.1\.4\.(240704|2407[1-9][0-9]|240[89][0-9]{2}|24(10|11|12)[0-9]{2}|25[0-9]{4}|26[0-9]{4})'; then
    echo "PATCHED - affected branch $VERSION detected, but OPatch inventory shows July 2024-or-later WLS patching"
    exit 0
  else
    echo "VULNERABLE - affected branch $VERSION detected and no July 2024-or-later WLS CPU/SPB evidence found in OPatch inventory"
    exit 1
  fi
fi

if [[ "$VERSION" == "14.1.1.0.0" ]]; then
  if echo "$INV" | grep -Eq '14\.1\.1\.0\.2407[0-9]{2}|14\.1\.1\.0\.240[89][0-9]{2}|14\.1\.1\.0\.24(10|11|12)[0-9]{2}|14\.1\.1\.0\.25[0-9]{4}|14\.1\.1\.0\.26[0-9]{4}|WLS STACK PATCH BUNDLE 14\.1\.1\.0\.2407[0-9]{2}|WLS PATCH SET UPDATE 14\.1\.1\.0\.2407[0-9]{2}|WLS STACK PATCH BUNDLE 14\.1\.1\.0\.24(08|09|10|11|12)[0-9]{2}|WLS STACK PATCH BUNDLE 14\.1\.1\.0\.25[0-9]{4}|WLS STACK PATCH BUNDLE 14\.1\.1\.0\.26[0-9]{4}'; then
    echo "PATCHED - affected branch $VERSION detected, but OPatch inventory shows July 2024-or-later WLS patching"
    exit 0
  else
    echo "VULNERABLE - affected branch $VERSION detected and no July 2024-or-later WLS CPU/SPB evidence found in OPatch inventory"
    exit 1
  fi
fi

echo "UNKNOWN - unable to classify installation"
exit 2

Sources

1. Oracle Critical Patch Update Advisory - July 2024
2. NVD CVE-2024-21182
3. CISA Known Exploited Vulnerabilities Catalog
4. Oracle WebLogic Cloud default ports guidance
5. Oracle WebLogic Server Stack Patch Bundle 12.2.1.4.240710 details
6. CIRCL vulnerability lookup for CVE-2024-21182
7. Public PoC repository
8. BleepingComputer report citing current Shodan exposure counts