Full Report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a maximum-severity security flaw impacting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-21962 (CVSS score: 10.0), allows an unauthenticated attacker with network access via HTTP to
Analysis Summary
# Vulnerability: Critical Improper Access Control in Oracle WebLogic Proxy Plug-in
## CVE Details
- **CVE ID:** CVE-2026-21962
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Improper Access Control (Specific CWE ID not provided in text, but categorized as such by CISA)
## Affected Systems
- **Products:**
- Oracle HTTP Server
- Oracle WebLogic Server Proxy Plug-in
- **Versions:** Not explicitly listed in the article (refer to Oracle January 2026 Critical Patch Update).
- **Configurations:** Systems utilizing the WebLogic Server Proxy Plug-in for network traffic routing via HTTP.
## Vulnerability Description
CVE-2026-21962 is a maximum-severity improper access control flaw. It allows an unauthenticated attacker with network access via HTTP to bypass security restrictions. The flaw enables unauthorized creation, deletion, or modification of critical data, as well as providing complete access to all data accessible through the Oracle HTTP Server and the WebLogic Server Proxy Plug-in.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV catalog).
- **Complexity:** Low (Described as "simple-to-exploit").
- **Attack Vector:** Network (via HTTP).
## Impact
- **Confidentiality:** Total (Complete access to all accessible data).
- **Integrity:** Total (Unauthorized creation, deletion, or modification of data).
- **Availability:** High (Potential for service disruption through data deletion or modification).
## Remediation
### Patches
- Oracle released patches for this vulnerability in the **January 2026 Critical Patch Update**. Users should update their Oracle HTTP Server and WebLogic Server components to the latest patched versions immediately.
### Workarounds
- No specific software workarounds were provided in the text. CISA mandates federal agencies (FCEB) to apply the formal patches by **August 27, 2026**.
## Detection
- **Indicators of Compromise (IoCs):**
- Traffic from IP address: `193.24.123[.]42` (Linked to early exploitation attempts).
- Monitor for concurrent exploitation attempts targeting other WebLogic flaws: CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, and CVE-2017-10271.
- **Detection methods:**
- Deployment of honeypots to identify scanning and exploitation patterns (as used by CloudSEK and GreyNoise).
- Review of HTTP server logs for unauthorized access patterns or unusual data modification requests.
## References
- **CISA KEV Catalog:** hxxps[://]www.cisa.gov/known-exploited-vulnerabilities-catalog
- **Vendor Advisory:** Oracle Critical Patch Update Advisory - January 2026 (Link not provided in source text)
- **Technical Reporting:** hxxps[://]thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html
- **CVE Record:** hxxps[://]www.cve.org/CVERecord?id=CVE-2026-21962