CVE-2026-21962

This vulnerability is like a “back door” inside the bridge between your Oracle web server and WebLogic. Attackers who can reach it over HTTP can use that back door to view, change, or delete important data without needing an account. Because it’s being used already in real attacks, it’s not just a theoretical risk.

This matters if your business runs Oracle HTTP Server and uses the WebLogic Server Proxy Plug-in (for Apache HTTP Server and/or for IIS) as part of your website or internal applications. The risk is specifically for network-accessible installations over HTTP, and it applies when you are using one of the affected plug-in versions. There’s no login needed for the attacker—so the key gate is whether the vulnerable service is reachable from a network (and exposed via HTTP), which is true in default configurations.

This is RED because CISA confirmed active exploitation and placed CVE-2026-21962 in its KEV catalog, with a mandatory remediation deadline of 2026-08-27. Attackers can reach it without a login over HTTP, so exposure can be immediate if the service is internet- or network-facing.

1. Identify exposure
   • Confirm whether you run Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and/or IIS.
   • Determine whether your installed versions include: 12.2.1.4.0 (also noted for the IIS plug-in), 14.1.1.0.0, or 14.1.2.0.0.
2. Confirm the scope
   • If the proxy plug-in is integrated, treat the proxy endpoints as part of the vulnerable surface because the findings indicate the attacker can act on critical data accessible through the plug-in.
3. Patch/upgrade (primary remediation)
   • Apply Oracle’s January 2026 CPU updates from trusted sources as directed by Oracle.
   • After upgrading, restart the affected Oracle HTTP Server / proxy plug-in components and re-check service health.
4. If patching cannot be completed before the deadline
   • Follow CISA guidance: apply vendor mitigations per Oracle instructions; if mitigations are unavailable, discontinue use of the product (or the affected proxy integration).
5. Verification checks (practical)
   • Validate that the vulnerable behavior is no longer reachable without authentication by re-testing the relevant proxy routes in a controlled manner (or using your vendor/security test tooling).
   • Review access and change logs for suspicious unauthenticated requests and unexpected create/modify/delete activity.
6. Timing
   • CISA KEV due date: 2026-08-27.
7. Ongoing monitoring
   • Monitor logs and alerting for repeated unauthenticated requests targeting proxy endpoints, and for unusual data changes originating from the web/proxy layer.

Severity is critical (CVE-2026-21962) with a maximum impact profile for confidentiality and integrity and no direct availability impact indicated by the reported vector; the practical risk includes unauthorized create/delete/modify of critical data accessible via the proxy. The weakness is categorized as CWE-284 (Improper Access Control). The attack vector is unauthenticated network access over HTTP (no authentication and no user interaction required).

Exploitation status: confirmed active exploitation, tracked in CISA KEV (added 2026-08-24) with a remediation due date of 2026-08-27. News reporting indicates early attacks were observed starting in January 2026 and that CISA confirmed active exploitation. Exploit maturity includes public PoC availability and reported exploitation by an identified actor (“SnowLight”).

Patch status: vendor remediation guidance points to applying January 2026 CPU updates from trusted sources. KEV status takes precedence over predicted likelihood; therefore the public EPSS prediction is not used to drive the urgency decision.