CVE Tools
Sign in

CVE-2026-21962

Published: Jan 20, 2026Updated: Aug 25, 2026 Sources: CVE List NVD BDUCWE-284
10.0CRITICAL
NVD MITRE
EPSS Score
42.0%
Top 1.4%
CISA KEV
Active Exploitation
Since Aug 24, 2026
Exploits
3 Known
Remediation
Patch Available
Self-Check
Not available

Description

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

In plain language

AI Act now

CVE-2026-21962 is a critical Oracle HTTP Server / WebLogic Server Proxy Plug-in flaw that lets attackers on the network break in and read or change data without any login—if you run these products, you should act now.

Executive summary

CVE-2026-21962 is an unauthenticated remote access flaw (CWE-284) in the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server / IIS, allowing an attacker with network access to bypass intended restrictions and perform remote read/modify/delete actions on accessible data.

If affected, business impact
Sensitive data exposureData tampering or deletionUnauthorized access to protected resourcesService disruption risk

What to do now

  1. Check whether you run Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache HTTP Server and/or for IIS, and identify which installed version matches 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0.
  2. If you are on an affected version, plan to upgrade/patch using the Oracle CPU for January 2026 from trusted sources.
  3. If a mitigation/upgrade is not available in the short term, discontinue use of the product (or the affected proxy integration) until a fix can be applied.
  4. After patching, verify the affected services restart successfully and confirm the proxy endpoints are no longer reachable in a way that allows unauthenticated changes.
Patch / advisory Some work to apply

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:CC:HI:HA:N
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:CScope
Changed
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:NAvailability
None
Open in CVSS calculator →

Weaknesses

CWE-284

Affected Products

Oracle Corporation
commercial·USaka Oracle Corp., oracle
Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-inOn-prem
Networking Infrastructure / load-balancer-proxy
HTTP ServerOn-premWeb App
Web & CMS Plugins
Oracle WebLogic Server Proxy Plug-InOn-prem
Databases / relational
weblogic server proxy plug-inOn-prem
Web & CMS Plugins
and 1 more affected products View all →

Exploitability

CISA Known Exploited Vulnerability
Added to KEV:Aug 24, 2026
Remediation due:Aug 27, 2026

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

3 exploit sources identified

Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.

View exploit details
Official Patch Available
Is your org exposed to CVE-2026-21962?We can run the check for you — a free external exposure review, no install. Check my exposure

References

https://www.oracle.com/security-alerts/cpujan2026.html
oracle.com
https://github.com/Ashwesker/Ashwesker-CVE-2026-21962
github.com
https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1
github.com
and 3 more references View all →
News mentions
3

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-21962 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows