CVE-2024-21006: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and…

PriorityP357high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

7.92%

94.1th percentile

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected

4 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Monitor for unauthenticated inbound connections over the T3 protocol to Oracle WebLogic Server, which is the attack vector for this CVE. ↗
→Monitor for unauthenticated inbound connections over the IIOP protocol to Oracle WebLogic Server, which is the attack vector for this CVE. ↗
→Focus detection on Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0, as these are the confirmed affected versions. ↗

·The vulnerability is in the Core component of Oracle WebLogic Server and is exploitable only when T3 or IIOP protocols are network-accessible. Restricting or disabling T3/IIOP access at the network perimeter (firewall) reduces attack surface. ↗
·This is an unauthenticated, remotely exploitable vulnerability (no privileges or user interaction required), meaning no authentication bypass is needed — any network-reachable WebLogic instance on T3/IIOP is at risk. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vendor_oracle7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.