Oracle CVE-2026-21962 enters KEV: maximum score and unauthorized access to WebLogic

A critical flaw published in January, now in the Known Exploited Vulnerabilities catalog

CISA has added vulnerability CVE-2026-21962 to the Known Exploited Vulnerabilities (KEV) catalog. The addition was recorded on August 24, 2026; the deadline for remediation by U.S. federal agencies is set for August 27, 2026.

The flaw affects Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and for IIS. Its CVSS v3 score is 10.0, the highest possible. The nature of the defect is improper access control (CWE-284): an unauthenticated attacker can act over the network via HTTP, without needing credentials or user interaction.

According to the CVE Program record, the vulnerability was published on January 20, 2026. The technical description indicates that a successful attack can cause unauthorized access, creation, deletion or modification of critical data, and in some cases, complete access to data accessible through the vulnerable components.

Technical details: vector, scope change, and data impact

The official CVSS 3.1 vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

In plain terms: network attack, low complexity, no privileges required, no user interaction, scope changed (S:C), high impact on confidentiality and integrity, no impact on availability. The scope change is a key point: although located in Oracle components, the flaw can involve other connected systems or applications.

The NVD entry classifies the vulnerability as CWE-284 (Improper Access Control), not as remote code execution. A CloudSEK report from March 2026, cited by Security Affairs, describes it instead as critical unauthenticated RCE with a CVSS score of 10.0. Both attributions should be reported: the official vector does not include availability impact, and the CVE Program description refers to data access and modification, not explicitly to code execution.

Affected versions and at-risk environments

According to the CVE Program record, the affected versions are:

• Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (Apache HTTP Server): 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
• Oracle WebLogic Server Proxy Plug-in for IIS: only version 12.2.1.4.0

The NVD entry lists only versions 12.2.1.4.0 for both components in the products field, but the extended description and the CVE Program record also include 14.1.1.0.0 and 14.1.2.0.0. The CVE Program data takes precedence.

An Oracle WebLogic proxy component exposed on the internet can offer an attacker a path to critical backend systems without requiring authentication. This makes environments that directly publish the plug-in or HTTP Server without adequate network restrictions particularly risky.

Active exploitation already observed between January and February

Exploitation activity is not theoretical. A high-interaction CloudSEK honeypot, active from January 22 to February 3, 2026, simulated an Oracle WebLogic Server 14.1.1.0.0 and recorded immediate and widespread attacks against CVE-2026-21962. In the report, the flaw is described as critical unauthenticated RCE.

In addition, the honeypot captured attempts against historical WebLogic RCE vulnerabilities:

• CVE-2020-14882/14883 — Console RCE (HTTP, unauthenticated)
• CVE-2020-2551 — RCE via IIOP
• CVE-2017-10271 — RCE via WLS-WSAT (T3, unauthenticated)

CloudSEK concludes that threat actors continue to target a small set of highly effective and easy-to-exploit vulnerabilities to compromise WebLogic environments. The presence of three CVEs dating back to 2020 and 2017 alongside the new flaw indicates that many systems remain exposed to issues known for years.

CISA, KEV, and operational directives: what changes for federal agencies

Addition to the KEV catalog imposes obligations on U.S. federal civilian executive branch (FCEB) agencies. For CVE-2026-21962, the remediation deadline is August 27, 2026. The action required by CISA is: apply mitigations according to vendor instructions, follow Binding Operational Directive BOD 22-01 for cloud services, or discontinue use of the product if mitigations are not available.

BOD 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities,” requires remediation by the specified date. Security Affairs cites this directive in relation to the Oracle flaw.

In parallel, on August 21, 2026, CISA also added CVE-2026-73570, an OS command injection in Zimbra Collaboration Suite (ZCS), to the KEV. The official alert for that CVE cites BOD 26-04, “Prioritizing Security Updates Based on Risk,” which establishes vulnerability management requirements for FCEB agencies, prioritizing KEV CVEs on publicly exposed assets. For the Zimbra flaw, the federal deadline was August 24, 2026. The two additions should not be confused: the official alert of August 21 concerns Zimbra, while data on the Oracle vulnerability comes from NVD, the CVE Program, and Security Affairs.

What organizations should do

No specific patch numbers are indicated for CVE-2026-21962 in the public record. The action required by CISA is generic: apply mitigations according to vendor instructions or discontinue the product. Private organizations are encouraged to consult the KEV catalog and remediate vulnerabilities present in their infrastructure.

In practical terms, the priority is to reduce exposure of Oracle WebLogic proxy components to the internet. If the plug-in or HTTP Server does not need to be reachable externally, it should be placed behind a VPN or firewall with restrictive rules. For the historical CVEs captured by the honeypot, the already known guidance remains valid: vendor updates for CVE-2017-10271, CVE-2020-14882, and CVE-2020-14883, and mitigations or decommissioning for CVE-2020-2551.

Context: Oracle and recent precedents in KEV

The entry of CVE-2026-21962 is not an isolated event. In the last 90 days, other vulnerabilities related to Oracle and affiliated vendors have entered the KEV catalog: CVE-2026-46817 (July 15, 2026), CVE-2026-35273 (June 12, 2026, associated with ransomware), and CVE-2024-21182 (June 1, 2026). Pressure on the Oracle ecosystem remains high, with WebLogic and middleware components continually targeted.

Organizations using Oracle HTTP Server or WebLogic proxy plug-ins should immediately verify installed versions and cross-reference them with those listed. The U.S. federal deadline is near, but the risk is not limited to the public sector: the CloudSEK honeypot demonstrated that attacks start automatically and without authentication.