CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24, giving federal civilian agencies until August 27 to remediate. The vulnerability sits in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS — the reverse-proxy layer that routes web traffic into backend WebLogic application servers. It carries a CVSS score of 10.0, the maximum possible, and Oracle shipped the patch back in its January 2026 Critical Patch Update. The KEV addition isn’t news of a new bug; it’s confirmation that a seven-month-old maximum-severity flaw is still being actively exploited at scale.

What’s Vulnerable

CVE-2026-21962 is an improper access control weakness in the WebLogic Server Proxy Plug-in component of Oracle Fusion Middleware. The plug-in is designed to forward specific, whitelisted request paths from a front-end Apache or IIS server into WebLogic while blocking direct access to everything else — including internal administration consoles, deployment endpoints, and other paths that were never meant to be internet-facing.

The flaw lets an unauthenticated, network-based attacker bypass those proxy access controls entirely using a combination of path traversal sequences and HTTP header manipulation. By crafting requests that abuse how the plug-in normalizes and matches paths before forwarding them, an attacker can reach backend WebLogic resources the proxy was supposed to gate off — including, in the worst case, administrative and deployment interfaces that lead to full remote code execution on the WebLogic server itself.

Affected releases span the currently supported WebLogic Server Proxy Plug-in line:

  • 12.2.1.4.0
  • 14.1.1.0.0
  • 14.1.2.0.0

No authentication, user interaction, or prior access of any kind is required — the attack arrives as ordinary-looking HTTP traffic aimed at the proxy front end.

Exploitation Timeline

Oracle patched CVE-2026-21962 as part of the January 20, 2026 Critical Patch Update, but attention on the flaw accelerated fast: a public proof-of-concept surfaced around January 21, and researchers recorded the first real-world exploitation attempts the very next day. By January 28, the SANS Internet Storm Center was reporting a wave of unusual inbound requests against WebLogic paths — malformed traversal sequences and manipulated headers consistent with CVE-2026-21962’s exploitation pattern. CloudSEK’s honeypot research and independent scanner tooling (including public scanning scripts on GitHub) documented sustained automated probing in the months since, dominated by generic HTTP scanning frameworks like libredtail-http and the Nmap Scripting Engine alongside more targeted exploitation attempts.

In other words: this has been a live, actively-weaponized bug since roughly 48 hours after patch release. CISA’s KEV addition in August reflects that exploitation has continued long enough, and broadly enough, to meet the bar for federal mandatory remediation — not a new discovery.

Impact

Oracle HTTP Server and the WebLogic Proxy Plug-in typically sit at the edge of enterprise deployments — fronting ERP systems, internal business applications, and other Fusion Middleware-based platforms that are rarely designed to be internet-exposed on their own. A successful exploit gives an attacker:

  • Unauthorized read access to data behind the proxy that was never meant to be reachable externally
  • The ability to create, delete, or modify data accessible through the compromised Oracle HTTP Server or backend WebLogic instance
  • In the most severe chains, a path to full remote code execution and complete compromise of the WebLogic application server

Because WebLogic deployments are common in large enterprises, government agencies, and financial institutions running legacy Oracle Fusion Middleware stacks, the exposure footprint is significant — and many of these systems are exactly the kind that go years between architecture reviews, meaning the proxy layer may not have been patched even though it’s been seven months.

Mitigation

  • Patch now if you haven’t. Apply Oracle’s January 2026 Critical Patch Update (CPU) to all Oracle HTTP Server and WebLogic Server Proxy Plug-in deployments — this has been available since January 20, 2026.
  • Assume compromise if unpatched since January. Given documented exploitation attempts dating to January 22 and sustained scanning since, treat any internet-facing, unpatched instance as potentially already compromised rather than merely at risk.
  • Review proxy and WebLogic access logs going back to January 2026 for malformed path traversal sequences, unusual header values, and requests to administrative or deployment endpoints that shouldn’t be reachable through the proxy.
  • Restrict network exposure of the proxy front end and backend WebLogic admin interfaces to trusted network segments wherever the application architecture allows it, independent of patch status.
  • Verify plug-in version post-patch — the fix applies to the proxy plug-in itself (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0), not just the WebLogic Server application, and both need to be current.

Track Oracle’s January 2026 Critical Patch Update advisory and CISA’s KEV catalog entry for CVE-2026-21962 for the authoritative remediation guidance and federal deadline details.