The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on August 24, 2026 added vulnerability CVE-2026-21962 with a maximum CVSS score of 10.0 to the Known Exploited Vulnerabilities (KEV) catalog, confirming it is being actively exploited. The vulnerability affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, allowing an unauthenticated attacker to gain full access to data or modify critical information via network access over HTTP. Organizations using these products must apply patches immediately — U.S. federal agencies are required to do so by August 27, 2026.
Technical details of the vulnerability
According to the CISA description, CVE-2026-21962 is an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. Key characteristics:
- CVSS score: 10.0 — the highest possible, indicating trivial exploitation and catastrophic impact
- Attack vector: network, over HTTP — no authentication or user interaction is required
- Impact of exploitation: unauthorized creation, deletion, or modification of critical data, as well as full access to all data exposed through Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in
- Exploitation status: confirmed active exploitation (listed in the CISA KEV catalog)
The CVSS score of 10.0, combined with the lack of any authentication requirement, makes this vulnerability one of the most dangerous in the Oracle ecosystem in recent years. An attacker only needs network access to the target server over HTTP — no additional conditions are required for compromise.
Timeline and context
Patches for CVE-2026-21962 were reportedly released by Oracle in January 2026. However, there was enough time between the release of the fix and its widespread deployment for attackers to begin actively exploiting the vulnerability. Inclusion in the KEV catalog seven months after the patch’s release is a clear indicator that a significant portion of installations remains unprotected.
It is worth noting that Oracle WebLogic Server has historically been a high-priority target for attackers. Vulnerabilities such as CVE-2020-14882 (remote code execution via the console), CVE-2020-2551 (remote code execution via IIOP), and CVE-2017-10271 (remote code execution via WLS-WSAT) continue to be exploited years after patches were released. The appearance of CVE-2026-21962 in the KEV catalog confirms a persistent trend: WebLogic remains one of the most heavily targeted enterprise-grade platforms.
Impact assessment
Oracle HTTP Server and Oracle WebLogic Server are widely used in enterprise environments to host mission-critical business applications, including enterprise resource management systems, e-commerce portals, and internal services. The highest risk is faced by:
- Financial sector — banks and insurance companies using Oracle Fusion Middleware
- Government agencies — especially those that have not yet complied with BOD 26-04 requirements
- Large enterprises with legacy WebLogic installations where the upgrade process is complicated by dependencies
- Organizations with internet-exposed servers — the vulnerability is exploited over HTTP without authentication
Full unauthorized access to data and the ability to modify it mean that successful exploitation can lead to leakage of confidential information, violation of business data integrity, and use of the compromised server as a foothold for further movement across the network.
Practical recommendations
Given the confirmed active exploitation and maximum criticality rating, the following course of action is recommended:
- Immediately install the Oracle patches — fixes have been available since January 2026. For U.S. federal agencies, the deadline is August 27, 2026, in accordance with Binding Operational Directive 26-04
- Inventory all instances of Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in in your infrastructure, including development and testing environments
- Restrict network access to Oracle WebLogic servers — if direct internet access is not a business necessity, block it using a firewall or WAF
- Review logs for anomalous HTTP requests to Oracle HTTP Server, especially for the period since January 2026 — the seven-month window between patch release and KEV inclusion suggests exploitation may have been ongoing for a long time
- Check for patches for older WebLogic vulnerabilities — CVE-2020-14882, CVE-2020-2551, and CVE-2017-10271 are still actively used by attackers and are often exploited in combination with newer vulnerabilities
If immediate updating is not possible, as a temporary measure you should isolate vulnerable servers at the network level and strengthen monitoring of incoming HTTP traffic to them.
The inclusion of CVE-2026-21962 in the CISA KEV catalog is not a recommendation but a statement of fact: the vulnerability is already being exploited. Organizations with Oracle HTTP Server or the WebLogic Server Proxy Plug-in in their infrastructure need to install Oracle’s January patches within days, not weeks. At the same time, it is advisable to audit all WebLogic installations to ensure fixes are in place for older yet still actively exploited vulnerabilities — attackers deliberately combine multiple entry points into this platform.
