CVE-2026-21962
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Aug 24, 2026
- US federal agencies must remediate it by Aug 27, 2026 (BOD 22-01)
- First attack observed 20 days after disclosure
- Confirmed by sensors, not only by reports
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 8, 2026 Aug 24, 2026 Aug 24, 2026 Jul 31, 2026 Jun 24, 2026 Mar 25, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NAffected products
| Vendors | Product | Versions |
|---|---|---|
| oracle | http server | 12.2.1.4.0 |
| oracle | weblogic server proxy plug-in | 12.2.1.4.0 |
Related articles
CISA flags five older flaws in ProFTPD, Struts, BIND, ONLYOFFICE and Strapi as exploited
CISA added five older ProFTPD, Struts, BIND, ONLYOFFICE and Strapi flaws to KEV amid reported China-linked exploitation campaign.
ShinyHunters Suspect Detained as Boeing Reviews Separate Jeppesen ForeFlight Data Claims
Sources allege ShinyHunters operator Rey sought to extort Jeppesen ForeFlight as Boeing reviews claims; detention and data theft remain unconfirmed.
ShinyHunters Probe Reaches the Netherlands as Attacks Shift Toward Higher-Risk Targets
Dutch police detained convicted hacker Pepijn van der Stap in ShinyHunters probe amid Odido theft, FBI portal breach and PeopleSoft flaw exploitation.
Encoded Requests Let ShinyHunters-Linked Attackers Breach Oracle PeopleSoft Servers
UNC6240 exploits CVE-2026-35273 in Oracle PeopleSoft via encoded PSEMHUB requests, bypassing WAFs to deploy JSP shells and SIDEEYE backdoor.
FBI Probes ShinyHunters Claim After Recruitment Portal Defacement
FBI investigates ShinyHunters claim of FBIjobs.gov breach, portal defacement and alleged theft of agent data. Scope remains unverified.
ShinyHunters Hijacks Clop’s Tor Leak Site and Turns Extortion Against Its Operator
ShinyHunters hacked Clop's Tor leak site via Grav CMS flaw, defaced it, claims server logs and onion keys, and threatens 72-hour extortion.
An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
ZBT: Two New Factory Implants in Chinese Routers Expose Remote Root Access
On August 28, 2026, The Hacker News confirmed through the IEEE registered MAC prefix database that the blocks 78:A3:51 and F8:5E:3C belong to Shenzhen
Gitea Under Attack: Critical RCE Exploited for Cryptojacking, CISA Mandates Patch by August 28
Critical RCE in Gitea (CVE-2026-60004) is being exploited for cryptojacking. CISA requires federal agencies to patch by August 28, 2026.
Oracle CVE-2026-21962 enters KEV: maximum score and unauthorized access to WebLogic
CISA adds Oracle CVE-2026-21962 to KEV catalog. Critical CVSS 10.0 flaw allows unauthorized WebLogic access. Remediation due Aug 27, 2026.
This product uses the NVD API but is not endorsed or certified by the NVD.