A January Oracle Patch Just Got a 72-Hour Federal Deadline — Here's What Happened in Between
CVE-2026-21962 shipped a fix in January. CISA didn't call it exploited until August. The seven months in between are the actual story.
On January 20, 2026, Oracle quietly fixed a CVSS 10.0 bug in the WebLogic Server Proxy Plug-in as one line in a Critical Patch Update that touched hundreds of products. Nobody outside a small circle of researchers noticed. On August 24, CISA added the same bug to its Known Exploited Vulnerabilities catalog and gave federal agencies the tightest deadline it's authorized to hand out: 72 hours. This is not a story about a new zero-day. It's a story about what happens to a maximum-severity bug in the seven months nobody's watching.
Scores as of 2026-09-02live record →
What the bug actually is
CVE-2026-21962 lives in the WebLogic Server Proxy Plug-in for Apache HTTP Server and for Microsoft IIS — the component that sits in front of a WebLogic cluster and routes traffic into it. It's tagged CWE-284, improper access control: an unauthenticated attacker with plain HTTP access to that proxy layer can read, create, delete or modify data the plugin is meant to protect, with a scope change into whatever sits behind it. Oracle's own scoring lands the same place NVD's does — 10.0, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — no authentication, no user interaction, low complexity. Affected versions are the Proxy Plug-in for Apache at 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, and the IIS variant at 12.2.1.4.0 only. It's worth being precise about scope here: this is not "every WebLogic install is exposed by default" — it's specifically the proxy plug-in deployments, which is exactly the DMZ-facing layer teams tend to forget is a distinct patchable component from WebLogic Server itself.
The timeline nobody was watching
Patch to federal deadline
- Oracle patches CVE-2026-21962Fixed in the January 2026 Critical Patch Update — one line among hundreds. No advisory fanfare beyond the standard CPU release.
- Public PoC lands, exploitation starts same dayResearcher gregk4sec publishes exploit code on GitHub. CloudSEK's honeypot logs the first live exploitation attempt from 67.213.118.179 within hours.
- Broader scanning beginsAdditional attacker IPs start probing CloudSEK's honeypot for this and older WebLogic RCEs — the opportunistic, automated-scanner phase.
- CloudSEK closes its 12-day honeypot windowStudy period ends. Findings (below) are specific counts from this window, not a headline total for the whole campaign.
- SOCRadar surfaces a China-nexus staging serverA six-week operational window of exposed adversary infrastructure links this CVE to the SNOWLIGHT malware family and access brokers UNC5174/UNC6586.
- CISA adds CVE-2026-21962 to KEVCiting evidence of active exploitation. Federal Civilian Executive Branch deadline set at August 27 — a 72-hour window, CISA's tightest.
What CloudSEK's honeypot actually recorded
CloudSEK researcher Vikas Kundu ran a high-interaction Oracle WebLogic honeypot from January 22 to February 3, 2026 — 12 days, starting the same day the public PoC dropped. Read directly, the report's own numbers are modest and mostly generic internet noise, not a wave specific to this CVE:
| Signal | Count | Detail |
|---|---|---|
| Requests to "/" | 2,138 | from 653 unique IPs — background scanning, not exploitation |
| libredtail-http tool traffic | 1,012 requests | 21 unique IPs |
| Nmap Scripting Engine traffic | 664 requests | 5 unique IPs |
| Generic web recon (non-WebLogic) | 967 requests | 78 unique IPs — includes Hikvision, PHPUnit, generic command-injection probes |
| Unique IPs specifically probing CVE-2026-21962 | 3 | first hit same day the PoC published |
That last row is the honest headline from CloudSEK's own data: three distinct IPs went after this specific CVE in the study window, riding rented VPS infrastructure from DigitalOcean and HOSTGLOBAL.PLUS. The broader 140,000-attempt figure — real, but Imperva's, and not scoped to 12 days — is the number that made headlines. Both are true. They answer different questions.
The part that got this onto KEV: a China-nexus campaign
The opportunistic scanning in January explains why the bug got weaponized fast. It doesn't explain why CISA acted in August. That's SOCRadar's contribution: its Threat Research Unit found an exposed adversary-operated staging server — reconnaissance target lists, nine weaponized CVEs, a cracked Chinese-language Cobalt Strike build, Metasploit, tunneling tools — spanning a six-week operational window. The retrieved malware matched the SNOWLIGHT family, tracked by Google's Threat Intelligence Group since 2024 and associated with China-nexus access brokers UNC5174 and UNC6586. More than 85% of the mapped reconnaissance targets resolved to government domains (.gov.*, .go.id and equivalents) across Taiwan, Colombia, Brazil, Indonesia, Nigeria, the Philippines and dozens of other countries — over 100 in total. CVE-2026-21962 was one of the exploit chains built from public GitHub PoC code in that toolkit, alongside the other eight weaponized CVEs.
CVSS, EPSS and KEV — why none of them warned you in January
This is a clean case study in why the three numbers on a CVE record answer different questions. CVSS said 10.0 from day one — maximum severity, and it stayed exactly there the whole time, because CVSS never moves and never claims to reflect real-world activity. EPSS, which does try to model near-term exploitation probability, currently sits at 42.0% (98.6th percentile) — high, but that's a snapshot taken after KEV listing pulled attention to the CVE; it was almost certainly much lower back in February when the honeypot activity was actually happening. KEV is the one built to answer "is this confirmed exploited right now," and it's also the slowest by construction — it requires someone to observe, attribute and report exploitation before CISA can act on it. None of the three is wrong here. They're just measuring different things at different points in a seven-month gap, and a patch cadence that waits for all three to agree waits too long.
Not the first time this pattern's shown up on this vendor
Oracle's July 2026 Critical Patch Update shipped five separate CVSS 9.8 unauthenticated WebLogic RCEs at once (CVE-2026-60198/99/60200/02/04) — a different bug class in a different component, still sitting at near-zero EPSS as of this writing because no public PoC has landed for those yet. The thesis of that piece was that the gap between a quiet CVSS-10 patch and a KEV listing is measured in "time elapsed since a PoC drops," not in how dangerous the bug actually is. CVE-2026-21962 is that thesis playing out on a different CVE: PoC dropped two days after the patch, opportunistic exploitation started the same day, and the KEV listing that should feel urgent today is actually catching up to something that's been true since January.
What to do about it
- Confirm you're actually running the Proxy Plug-in — for Apache HTTP Server (12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0) or IIS (12.2.1.4.0 only), not just WebLogic Server itself. The plug-in is a separate, often-forgotten install.
- If you haven't applied the January 2026 CPU to the proxy tier, do it now — this has been a live exploitation target for over seven months, not a fresh disclosure.
- If you're a federal agency under BOD 26-04, the deadline (August 27) has already passed; report status and close the gap immediately.
- Everyone else: treat the 72-hour KEV deadline as the floor, not the target — the SOCRadar findings show this bug is already inside a resourced campaign, not just scanner noise.
- Check DMZ-facing proxy plug-in instances specifically — this is exactly the 'trusted gateway' layer that's easy to exclude from routine internal vulnerability scans.
CVE data current as of 2026-09-02live record →