CISA flags two-year-old Oracle flaw as actively exploited in attacks

CISA has issued an emergency directive for federal agencies to patch a two-year-old, critical Oracle WebLogic Server vulnerability (CVE-2021-2109) that is now being actively exploited.

Technical Breakdown

• Vulnerability: CVE-2021-2109, a critical Oracle WebLogic Server flaw initially patched in January 2021.
• TTPs: Allows unauthenticated Remote Code Execution (RCE) through a low-complexity network attack.
• IOCs: No specific Indicators of Compromise (IPs, hashes) are detailed in the provided summary.
• Affected: Unpatched instances of Oracle WebLogic Server.

Defense

Immediate application of the existing patch for CVE-2021-2109 is critical. CISA has ordered government agencies to secure their systems, highlighting the active exploitation.

Source: https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-weblogic-flaw/