Oracle WebLogic CVE-2026-21962 exploited, CISA adds to
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnera
What Happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog on Monday. The flaw, tracked as CVE-2026-21962, carries a CVSS score of 10.0 and allows unauthenticated attackers to access critical data on affected systems. CISA’s inclusion in the KEV catalog confirms active exploitation in the wild, triggering a binding operational directive for federal agencies to remediate within a mandated timeframe.
Why It Matters
Oracle WebLogic Server is a widely deployed enterprise Java application server, often positioned at the network perimeter to host business-critical applications and web services. The unauthenticated nature of this vulnerability eliminates the need for valid credentials or user interaction, lowering the barrier for attackers significantly. Organizations running affected versions are exposed to direct data exfiltration, potentially including sensitive customer records, proprietary business logic, or authentication material. For security teams, the KEV designation is a strong signal that threat actors are actively scanning for and exploiting this flaw, not merely theorizing about it. Failure to patch promptly places organizations squarely in the crosshairs of both opportunistic botnets and targeted intrusion campaigns.
Technical Details
The vulnerability resides in the Oracle WebLogic Server Proxy Plug-in, a component that enables WebLogic to integrate with Oracle HTTP Server. The flaw stems from improper handling of specific HTTP requests, which can be exploited remotely without authentication. An attacker can craft a malicious request to the proxy plug-in to gain unauthorized access to sensitive data stored or processed by the underlying WebLogic server.
Because the plug-in operates at the interface between the web server and the application server, the attack surface is broad: any externally reachable deployment of Oracle HTTP Server fronting WebLogic is potentially vulnerable. The CVSS 10.0 rating reflects the combination of network exploitability, no authentication requirements, and high confidentiality impact. CISA did not disclose technical proof-of-concept details in its advisory, but the active exploitation noted suggests that functional exploit code is already available in the threat landscape.
Immediate Risk
The immediate risk is severe. With CISA confirming active exploitation, organizations should treat every unpatched Oracle WebLogic Server with the Proxy Plug-in as compromised. The window between public disclosure and weaponized exploitation is historically short for WebLogic vulnerabilities. Attackers can leverage this flaw to harvest data silently, with no logs indicating unauthorized authentication events, since the exploit bypasses credential checks entirely. Given the typical deployment of WebLogic on the network edge, any external-facing instance is likely being probed already. The urgency is compounded for federal agencies subject to the KEV remediation timeline, but commercial organizations face an equal practical threat.
Security Insight
The pattern here mirrors the 2020-era exploitation of WebLogic vulnerabilities, where attackers pivoted from RCE to data theft as a primary objective. What’s notable about CVE-2026-21962 is the focus on data access rather than code execution, suggesting a shift toward stealthy exfiltration over disruptive ransomware.
Defensive teams should not assume that patching the application server alone closes the gap. The Proxy Plug-in may be distributed as part of a separate component installation, meaning the vulnerable code could persist even after a WebLogic Server patch is applied. Verify that the Oracle HTTP Server and its associated plug-in binaries are updated to versions that specifically address CVE-2026-21962. Additionally, audit network traffic to WebLogic endpoints for anomalous request patterns, as the exploitation method does not generate authentication logs. Treat the absence of evidence as no proof of safety and prioritize a full forensic review of any perimeter WebLogic systems.
Further Reading
Never miss a security update
Get real-time security alerts delivered to your preferred platform.
Related News
North Korean hackers have been exploiting a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies as part of the Operation Dream Job campaign. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical-severity security flaw impacting Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catal
A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in t