The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about the active exploitation of a vulnerability in Oracle WebLogic that was patched nearly two years ago. The vulnerability, identified as CVE-2024-21182, was addressed by Oracle in its July 2024 Critical Patch Update for the Java application server. Despite the availability of proof-of-concept exploits soon after its announcement, CISA's alert marks the first official acknowledgment of its exploitation in the wild. The flaw allows remote, unauthenticated attackers to potentially gain unauthorized access to critical data, or even to all data accessible through affected Oracle WebLogic Server instances. CISA has included this vulnerability in its Known Exploited Vulnerabilities catalog, urging federal agencies to mitigate it promptly by June 4. The catalog also lists several other WebLogic Server vulnerabilities, most of which were patched by Oracle years before their inclusion. Organizations using Oracle WebLogic are strongly advised to review their systems and ensure that all relevant patches are applied to prevent unauthorized access and data breaches.