CVE-2024-21182: Oracle WebLogic Server -- Unauthenticated Information Disclosure via T3/IIOP

Background

CVE-2024-21182 is a pre-authentication information disclosure vulnerability in Oracle WebLogic Server, exploitable via the T3 and IIOP protocols. Both protocols are enabled by default in WebLogic and are used for Java EE inter-component communication — T3 is Oracle’s proprietary extension of Java RMI, while IIOP is the CORBA-based equivalent. The vulnerability allows an unauthenticated remote attacker to read sensitive information from the server by sending specially crafted T3 or IIOP requests that trigger JNDI lookups to attacker-controlled infrastructure.

Oracle patched the vulnerability in the July 2024 Critical Patch Update. CISA added it to the Known Exploited Vulnerabilities catalogue on 1 June 2026, with a Federal Civilian Executive Branch remediation deadline of 4 June 2026 — indicating active exploitation has been confirmed. EPSS score is 87.67% (99.48th percentile), placing this among the most likely-to-be-exploited vulnerabilities currently tracked.

Technical Mechanism

WebLogic’s T3 and IIOP listeners handle incoming Java object serialisation traffic. The vulnerability arises from insufficient validation of JNDI (Java Naming and Directory Interface) lookup targets embedded within inbound T3/IIOP messages:

1. An attacker sends a crafted T3 or IIOP request to the WebLogic listener (default ports 7001/7002)
2. The server processes the embedded JNDI reference without adequate input validation
3. The WebLogic JVM makes an outbound JNDI lookup to an attacker-controlled LDAP or RMI server
4. The attacker’s server responds with a payload designed to exfiltrate data or trigger further interaction
5. Sensitive data from the server’s runtime context is disclosed as part of the JNDI lookup exchange

The attack is fully pre-authentication — no credentials or session are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network-accessible exploitation with no privileges required, no user interaction, and high impact on confidentiality.

The class of vulnerability — JNDI injection via deserialization protocols — is well-understood in the WebLogic attack surface. Oracle has patched multiple related issues in this code path over several years; CVE-2024-21182 represents a bypass or variant of prior mitigations. A public PoC was published by k4it0k1d on 31 December 2024.

Real-World Exploitation Evidence

CISA’s addition to the KEV catalogue on 1 June 2026 confirms active exploitation in the wild. The 3-day FCEB remediation deadline (due 4 June 2026) is unusually short and reflects the urgency of the threat. The high EPSS score (87.67%) predated active exploitation confirmation, meaning the research community assessed exploitation as highly likely based on the vulnerability class, public PoC availability, and the prevalence of internet-exposed WebLogic instances.

Oracle WebLogic is widely deployed in enterprise Java environments, particularly in financial services, telecoms, and government — sectors that are consistent targets for both espionage-motivated threat actors and ransomware groups. The T3/IIOP attack surface is frequently probed by automated scanners.

Impact Assessment

• Pre-auth information disclosure — no credentials needed; fully network-accessible
• Sensitive runtime data exposure — depending on server configuration, disclosed data may include configuration values, credentials, internal network topology, or session data accessible via JNDI
• Chaining potential — information disclosure from a complex Java EE server often enables follow-on attacks; obtaining internal addresses, credentials, or API keys creates pathways to deeper compromise
• Internet-facing exposure — WebLogic T3/IIOP ports are frequently exposed on the internet; scanning for port 7001/7002 is routine in threat actor playbooks
• Default-on protocols — T3 and IIOP are enabled by default in standard WebLogic deployments; organisations that haven’t explicitly disabled them are affected regardless of whether they actively use the feature

Affected Versions

Remediation Steps

Priority: Apply July 2024 Oracle CPU immediately.

1. Apply the Oracle Critical Patch Update from July 2024 for WebLogic Server 12.2.1.4.0 and 14.1.1.0.0
2. If patching cannot be done immediately, apply the following workarounds:
   • Disable IIOP if not required: in the WebLogic Admin Console → Servers → [server] → Protocols → IIOP → uncheck “Enable IIOP”
   • Apply T3 connection filter to restrict access to trusted source IPs only:

     weblogic.security.net.ConnectionFilter=weblogic.security.net.ConnectionFilterImpl
     weblogic.security.net.ConnectionFilterRules=<trusted_ip>/32 * allow\n* * * deny

   • Block ports 7001/7002 at the network perimeter for all untrusted source IPs
3. Review WebLogic firewall rules: T3/IIOP ports should never be internet-accessible unless absolutely required
4. Check for signs of prior exploitation (see Detection Guidance below) before treating patching as sufficient

Detection Guidance

Outbound JNDI lookup detection:

• Alert on outbound LDAP (port 389/636) or RMI (port 1099) connections originating from the WebLogic JVM process
• Any outbound JNDI lookup to an external IP is anomalous — WebLogic should not initiate lookups to arbitrary external servers

T3/IIOP traffic monitoring:

# Suricata — detect T3 handshake to non-standard destinations
alert tcp any any -> $EXTERNAL_NET 7001:7002 (msg:"CVE-2024-21182 T3 probe to internet"; flow:established,to_server; content:"t3 "; offset:0; depth:10; classtype:attempted-recon; sid:2024211820; rev:1;)

SIEM rule (WebLogic outbound JNDI):

process_name IN ("java", "weblogic") AND
network_direction = "outbound" AND
destination_port IN (389, 636, 1099) AND
NOT destination_ip IN (<internal_subnet_list>)

Log analysis:

• Check WebLogic server logs for T3 or IIOP connection attempts from unexpected source IPs
• Look for JNDI-related exceptions or stack traces in server.log — these may indicate failed exploitation attempts

Indicators of compromise:

• Unexpected outbound connections from WebLogic JVM to external LDAP/RMI servers
• Unusual T3 traffic patterns on 7001/7002 from IPs not in the application tier

Timeline

References

• NVD — CVE-2024-21182
• CISA KEV — CVE-2024-21182
• Oracle Security Alert — CVE-2024-21182