CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24, confirming that attackers are using the maximum-severity flaw against Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. Administrators running an affected proxy component should apply Oracle’s January 2026 Critical Patch Update now and preserve relevant HTTP and application logs before they rotate.
The important scope is narrower than “every WebLogic server.” Oracle identifies the vulnerable components as the WebLogic Server Proxy Plug-in for Apache HTTP Server and for Microsoft IIS, including deployments bundled with Oracle HTTP Server. A WebLogic installation is not automatically exposed simply because the product name appears in the CVE.
Which Oracle components are affected?
Oracle rates CVE-2026-21962 at CVSS 10.0. The attack can arrive over HTTP without authentication, user interaction, or existing privileges. Oracle’s risk matrix lists low attack complexity, changed scope, high confidentiality and integrity impact, and no direct availability impact.
| Deployment | Affected versions and action |
|---|---|
| Oracle HTTP Server / WebLogic Proxy Plug-in for Apache | 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Apply the relevant January 2026 Critical Patch Update through Oracle’s supported patch process. |
| WebLogic Proxy Plug-in for IIS | 12.2.1.4.0 only, according to Oracle’s note. Apply the relevant Oracle patch. |
| WebLogic Server without the affected proxy component | Do not infer exposure from the WebLogic product name alone. Inventory the front-end plug-in and its version. |
CISA set August 27, 2026 as the remediation deadline for US federal civilian agencies. That deadline is a government requirement, not a safe waiting period for other organizations. An internet-facing affected proxy should be treated as urgent today.
What active exploitation does and does not confirm
The official evidence confirms active exploitation of an improper-access-control vulnerability. Oracle says a successful attacker may read critical data and create, delete, or modify data accessible through the vulnerable Oracle HTTP Server or proxy component. CISA does not name an actor, campaign, payload, or victim, and it lists ransomware use as unknown.
Some public write-ups describe CVE-2026-21962 as remote code execution and circulate request patterns or proof-of-concept claims. Oracle’s published CVSS vector records high confidentiality and integrity impact but no availability impact, while CISA names the issue as improper access control. Those official descriptions do not establish that every reported request sample is valid or that arbitrary operating-system command execution is the confirmed impact. Do not build incident conclusions around an unverified public PoC.
Likewise, a blocked request matching a generic traversal pattern is not proof that the server was compromised. It is a reason to preserve the event, identify the destination component and version, and correlate the request with application, reverse-proxy, host, identity, and data-access telemetry.
What administrators should do now
- Inventory the actual proxy layer. Identify Oracle HTTP Server instances and WebLogic Proxy Plug-ins loaded by Apache HTTP Server or IIS. Record the component version, patch inventory, listening address, and whether untrusted networks can reach it.
- Preserve evidence before routine cleanup. Export front-end access and error logs, Oracle HTTP Server and WebLogic logs, WAF events, authentication records, and relevant host telemetry. Keep timestamps and time-zone information intact.
- Apply Oracle’s January 2026 Critical Patch Update. Use the supported patch path for the exact component and test the proxy-to-WebLogic route after the change. If patching cannot happen immediately, remove the affected service from public reach or restrict it to trusted networks; do not treat a WAF signature as a permanent substitute.
- Hunt for impact, not only one request string. Review unusual access to internal or normally restricted application paths, unexpected reads or exports, and unexplained creation, deletion, or modification of data reachable through the proxy. Compare activity before and after the first suspicious request.
- Escalate confirmed anomalies. If evidence shows unauthorized data access or changes, isolate the affected tier, preserve snapshots and logs, identify downstream systems reachable through the proxy, and rotate exposed credentials or secrets from a clean administrative workstation.
- Recheck after remediation. Confirm the patched component is the one receiving production traffic, repeat the exposure inventory, and monitor for new anomalous requests or data changes.
Home users do not need to scan personal PCs because of this CVE. The action belongs to teams operating Oracle HTTP Server or the WebLogic Proxy Plug-in. A normal endpoint malware scan cannot replace server patching or determine whether data behind the proxy was accessed.
References
- Oracle. “Oracle Critical Patch Update Advisory — January 2026.” Oracle Security Alerts, January 20, 2026, accessed August 24, 2026. Oracle advisory.
- Cybersecurity and Infrastructure Security Agency. “CISA Adds One Known Exploited Vulnerability to Catalog.” CISA, August 24, 2026. CISA alert.
