CISA Orders Urgent Patching for Actively Exploited Oracle WebLogic Flaw
CISA has added a critical remote code execution vulnerability in Oracle HTTP Server and the WebLogic Server Proxy plugin, tracked as CVE-2026-21962, to its Known Exploited Vulnerabilities catalog. The max-severity flaw allows unauthenticated network access and has been actively exploited in the wild since January. Federal civilian agencies have been given a tight deadline to apply the patches released by Oracle earlier this year.
Commentary
WebLogic infrastructure remains a perennial favorite for automated scanners and targeted campaigns alike, often serving as an easy entry point for external attackers. Because this flaw allows unauthenticated remote access through the HTTP server proxy component, organizations running these exposed instances must audit perimeter controls immediately. Beyond applying Oracle's January patches, security teams should look for indicators of compromise related to unauthorized data modifications and ensure these proxy plugins are never directly exposed without strict segmentation.
The Quote to Remember
“Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion, or modification access to critical data”