Unauthenticated attackers exploit remote code execution flaws in Oracle WebLogic and HTTP Server plug-ins

Summary

CISA has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, ordering federal agencies to remediate the flaw by August 27, 2026. The vulnerability, which carries a CVSS score of 10.0, allows unauthenticated attackers with network access via HTTP to achieve unauthorized access to critical data or complete control over accessible data within the Oracle HTTP Server and WebLogic Server Proxy plug-in.

Exploitation attempts were first observed as early as January 22, 2026, following the public release of a proof-of-concept exploit. While the specific attacks that triggered the CISA alert remain unconfirmed, security researchers have tracked various exploitation trends throughout the year.

Exploitation status

The vulnerability has been active in the wild for much of 2026. CloudSEK reported honeypot observations of exploitation attempts starting January 22, immediately following the publication of a public proof-of-concept.

In June, FalconFeeds noted the vulnerability's presence within the cybercrime supply chain, though specific attack details were not provided. By July, SOCRadar reported that a China-linked threat actor was using CVE-2026-21962 in attacks targeting government infrastructure.

CISA officially added the vulnerability to its KEV catalog on August 24, 2026, signaling that the flaw is being widely exploited in real-world attacks.

Technical details

The flaw is an improper access control vulnerability (CWE-284) residing in the Oracle HTTP Server and the Oracle WebLogic Server Proxy plug-in. This plug-in serves as a bridge between the HTTP Server and WebLogic.

Successful exploitation allows an unauthenticated attacker to perform unauthorized creation, deletion, or modification of critical data. Because the vulnerability exists in the proxy plug-in, the impact can extend beyond the initial component to significantly impact additional products.

The vulnerability affects the following versions:

Why this matters for defenders

This is a maximum-severity vulnerability. Because it requires no authentication and can be triggered via standard HTTP requests, any internet-facing Oracle HTTP Server or WebLogic proxy is a high-priority target.

The scope of the vulnerability allows for a "scope change," meaning an attacker can move from the proxy plug-in to compromise the broader WebLogic environment. This makes the flaw a primary target for both cybercrime supply chains and nation-state actors targeting government infrastructure.

Defender guidance

Apply the patches included in Oracle's January 2026 updates immediately.

If patching cannot be performed instantly, prioritize identifying all instances of the WebLogic Server Proxy plug-in, specifically those running on IIS, as the affected versions for that specific product are limited to 12.2.1.4.0.

Monitor network traffic for unusual HTTP requests targeting the WebLogic proxy components and audit access logs for unauthorized data modification or deletion attempts.