TLDR Tech / InfoSec
Two-year old Oracle WebLogic Server vulnerability is being exploited
CISA added CVE-2024-21182, a CVSS 7.3 Oracle WebLogic Server flaw that lets an unauthenticated attacker access critical data, to its Known Exploited Vulnerabilities catalog on Monday, confirming active exploitation and giving federal admins until Thursday to patch affected versions 12.2.1.4.0 and 14.1.1.0.0. The bug was fixed in Oracle's July 2024 Critical Patch Update, and researchers note that its late KEV addition fits a pattern in which more than 40 percent of catalog entries are listed two or more years after release, often catching organizations that patch slowly. Given an average 60-day patch window against attackers who weaponize exploits within hours or days, admins should treat this as a now-priority fix and not wait, as the moderate CVSS score understates real-world risk.
Read the full story