CISA flags two-year-old Oracle flaw as actively exploited in attacks
Source Bleeping Computer
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 3 Jun 2026, 01:31 UTC
What to do
AI-suggested
A security patch for CVE-2024-21182 has been available since July 2024. Federal agencies are mandated by CISA's Binding Operational Directive 22-01 to apply the patch by June 4, 2026. Organizations should promptly apply the official Oracle security updates to affected Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0. If patching is not immediately possible, follow vendor instructions for mitigations or consider discontinuing use of the affected product until patched. CISA strongly urges all network defenders, including private sector entities, to apply these patches as soon as possible to mitigate ongoing exploitation risks.
Description
CISA has ordered government agencies to secure their systems against a high-severity Oracle WebLogic Server vulnerability that was patched two years ago and is now actively exploited in attacks. [...]