Oracle WebLogic CVE-2026-21962 exploited, CISA adds to
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnera
What Happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog on Monday. The flaw, tracked as CVE-2026-21962, carries a CVSS score of 10.0 and allows unauthenticated attackers to access critical data on affected systems. CISA’s inclusion in the KEV catalog confirms active exploitation in the wild, triggering a binding operational directive for federal agencies to remediate within a mandated timeframe.
Why It Matters
Oracle WebLogic Server is a widely deployed enterprise Java application server, often positioned at the network perimeter to host business-critical applications and web services. The unauthenticated nature of this vulnerability eliminates the need for valid credentials or user interaction, lowering the barrier for attackers significantly. Organizations running affected versions are exposed to direct data exfiltration, potentially including sensitive customer records, proprietary business logic, or authentication material. For security teams, the KEV designation is a strong signal that threat actors are actively scanning for and exploiting this flaw, not merely theorizing about it. Failure to patch promptly places organizations squarely in the crosshairs of both opportunistic botnets and targeted intrusion campaigns.
Technical Details
The vulnerability resides in the Oracle WebLogic Server Proxy Plug-in, a component that enables WebLogic to integrate with Oracle HTTP Server. The flaw stems from improper handling of specific HTTP requests, which can be exploited remotely without authentication. An attacker can craft a malicious request to the proxy plug-in to gain unauthorized access to sensitive data stored or processed by the underlying WebLogic server.
Because the plug-in operates at the interface between the web server and the application server, the attack surface is broad: any externally reachable deployment of Oracle HTTP Server fronting WebLogic is potentially vulnerable. The CVSS 10.0 rating reflects the combination of network exploitability, no authentication requirements, and high confidentiality impact. CISA did not disclose technical proof-of-concept details in its advisory, but the active exploitation noted suggests that functional exploit code is already available in the threat landscape.
Immediate Risk
The immediate risk is severe. With CISA confirming active exploitation, organizations should treat every unpatched Oracle WebLogic Server with the Proxy Plug-in as compromised. The window between public disclosure and weaponized exploitation is historically short for WebLogic vulnerabilities. Attackers can leverage this flaw to harvest data silently, with no logs indicating unauthorized authentication events, since the exploit bypasses credential checks entirely. Given the typical deployment of WebLogic on the network edge, any external-facing instance is likely being probed already. The urgency is compounded for federal agencies subject to the KEV remediation timeline, but commercial organizations face an equal practical threat.
Security Insight
The pattern here mirrors the 2020-era exploitation of WebLogic vulnerabilities, where attackers pivoted from RCE to data theft as a primary objective. What’s notable about CVE-2026-21962 is the focus on data access rather than code execution, suggesting a shift toward stealthy exfiltration over disruptive ransomware.
Defensive teams should not assume that patching the application server alone closes the gap. The Proxy Plug-in may be distributed as part of a separate component installation, meaning the vulnerable code could persist even after a WebLogic Server patch is applied. Verify that the Oracle HTTP Server and its associated plug-in binaries are updated to versions that specifically address CVE-2026-21962. Additionally, audit network traffic to WebLogic endpoints for anomalous request patterns, as the exploitation method does not generate authentication logs. Treat the absence of evidence as no proof of safety and prioritize a full forensic review of any perimeter WebLogic systems.
Further Reading
Never miss a security update
Get real-time security alerts delivered to your preferred platform.
Related News
Cisco warned customers to patch a critical Secure Email Gateway zero-day security flaw that threat actors have been exploiting in attacks. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vuln
GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in
Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. [.