A patch that should have retired an Oracle WebLogic vulnerability two years ago is now the reason CISA is sounding an emergency alarm. After confirming active exploitation of a previously patched vulnerability, CVE-2024-21182, the Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog. By making this designation, CISA has signaled that the vulnerability has moved from a potential risk to an active threat requiring immediate attention. According to Oracle, the vulnerability affects Oracle WebLogic servers running on two specific versions and allows any unauthenticated attacker to gain remote access through exposed T3 and IIOP protocols. Upon successfully exploiting this vulnerability, attackers can gain full access to all data accessible through the server. Although Oracle issued a patch for it in July 2024, several systems remain unpatched, creating an entry point for the recently observed exploitation of this flaw. CISA’s KEV listing places it among high-priority threats with urgent remediation requirements for all federal agencies, and as a broader call for the private sector to patch their vulnerable, unpatched servers. Unpacking the WebLogic …