CVE-2026-21962 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-01-20

Added to CISA KEV: 2026-08-24 216 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in the CISA KEV catalog with confirmed active exploitation. Immediately hunt for indicators of compromise — review HTTP/proxy access logs for anomalous or unauthorized request patterns, inspect WebLogic backend access, check for unauthorized data access/modification, and verify system integrity.
Apply Oracle's January 2026 Critical Patch Update (cpujan2026) fixes for the affected Oracle HTTP Server / WebLogic Server Proxy Plug-in versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) immediately.
If patching cannot be done immediately, restrict network access to the affected proxy service, apply WAF rules to block anomalous request paths, and enforce strict upstream authorization controls.
Continuously monitor proxy and WebLogic logs for authorization bypass attempts and unusual data access, and enable alerting on suspicious HTTP request patterns.
Patch priority: EMERGENCY / IMMEDIATE — internet-facing, unauthenticated, CVSS 10.0, actively exploited.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-21962 is an improper access control vulnerability (CWE-284) affecting the Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in within Oracle Fusion Middleware ^[1]^[6]. The vulnerability occurs because the plug-in fails to properly enforce authorization checks on incoming HTTP requests when fronting WebLogic backends, allowing unauthorized parties to bypass security boundaries ^[1]. This is a critical security flaw because it enables unauthenticated actors to access, modify, or delete sensitive data, making it a high-priority risk for organizations using these components in internet-facing configurations ^[3]^[5].

Exploitation

Active Exploitation: The vulnerability is confirmed to be actively exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) Catalog as of August 2026 ^[4]^[7].
Threat Actors: While active exploitation is documented, specific attribution to named threat actors or ransomware campaigns remains subject to ongoing security analysis and reporting.
Exploit Availability: Public evidence indicates the vulnerability is actively utilized by attackers, and it is categorized as a frequent and dangerous attack vector for compromised environments ^[4].
Attack Prerequisites: Exploitation can be performed remotely over the network without requiring prior authentication or user interaction ^[5].

Affected Products & Patches

Affected Versions: The vulnerability impacts Oracle WebLogic Server Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 ^[1].
Patches: Administrators are advised to review official Oracle security updates and apply the necessary patches or hotfixes for the affected product versions immediately to remediate the flaw ^[2].
Mitigation/Workarounds: Organizations should restrict network access to the affected service if patching is not immediately feasible and monitor system logs for signs of unauthorized HTTP request patterns or access anomalies ^[2].

Impact

Access Capability: Successful exploitation allows an unauthenticated remote attacker to gain unauthorized access to critical data, potentially including the ability to read, alter, or delete information processed by the WebLogic backend ^[3]^[5].
Business Risk: Internet-facing deployments face a severe risk of data breach, unauthorized data manipulation, and potential service disruption, as the vulnerability provides a direct pathway for external attackers to interact with internal middleware components that are intended to be protected by authorization checks ^[1].

Sources

CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy ...
CVE-2026-21962 is an improper access control flaw (CWE-284) in the WebLogic Server Proxy Plug-in component of Oracle HTTP Server, affecting versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The plug-in, which fronts WebLogic backends from Apache HTTP Server or IIS, fails to enforce authorization chec…
CVE-2026-21962 Exploited: Patch Oracle HTTP Proxy
CISA confirms CVE-2026-21962 exploitation. Check affected Oracle HTTP Server and WebLogic Proxy Plug-in versions, patch now, and preserve logs.
CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy ...
CVE-2026-21962 is an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. In plain terms, the software does not correctly enforce who is allowed to create, change, delete, or read certain data it can reach.
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability This type of vulnerability is a frequent attack vector…
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers ...
CISA adds actively exploited CVE-2026-21962 to KEV; the Oracle flaw can expose or alter critical data via unauthenticated HTTP access.

🔴 CVE-2026-21962