Product

Oracle Fusion Middleware

0 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 19, 2026 · last 22d ago

Timeline3 articles

Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2

CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.

Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.

Canadian Centre for Cyber SecurityAug 24, 18:42 UTC · 22d agoExploit / PoC in the wildCVE-2026-21962

Oracle Critical Patch Update, August 2026 Security Update Review

Oracle's August 2026 Critical Patch Update fixes 943 vulnerabilities; Oracle Fusion Middleware and Hyperion received the most patches at 262.

Oracle released its August 2026 Critical Patch Update, addressing 943 security vulnerabilities across multiple product families, including third-party components bundled in Oracle products. Oracle Fusion Middleware and Oracle Hyperion received the highest number of fixes with 262 patches. Several of the addressed vulnerabilities impact more than one product.

Qualys ThreatPROTECTAug 19, 13:49 UTC · 27d agoAdvisory2

Oracle August 2026 Critical Security Patch Update Addresses 925 CVEs

Oracle's August 2026 CSPU fixes 925 CVEs across 943 patches, including 154 critical fixes; Fusion Middleware gets 262 patches.

Oracle released its August 2026 Critical Security Patch Update on August 18, addressing 925 unique CVEs with 943 security updates. 154 issues (16.3%) carry a critical severity rating. Oracle Fusion Middleware received the most patches at 262, accounting for 27.8% of the total. Oracle introduced the monthly CSPU cycle in May 2026 as an interim release between quarterly Critical Patch Updates.

Tenable BlogAug 19, 00:41 UTC · 28d agoAdvisory

Related CVEsby mentions

CVE-2026-2196210.042%
Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (components: the plug-in for Apache HTTP Server and the plug-in for IIS), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can trivially exploit it, and the scope-change designation means a successful attack can significantly impact additional products beyond the plug-in itself. The attacker gains unauthorized access to critical data (potentially all accessible data) as well as the ability to create, delete, or modify critical data, reflected in the maximum CVSS 10.0 score with high confidentiality and integrity impacts and no availability impact. Organizations running the affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the Apache plug-in, and 12.2.1.4.0 only for the IIS plug-in - especially those with internet-facing Apache/IIS/OHS front ends proxying WebLogic applications, are exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-24, and EPSS assigns a 42% probability of exploitation within 30 days, though no public proof-of-concept is known.
· Oracle HTTP Server (Oracle Fusion Middleware) 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 · Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 KEVlarge

Appears with

vendor Oracle 3 organization Oracle 2 product Oracle HTTP Server 1 product Oracle Hyperion 1 product Oracle WebLogic Server Proxy Plug-in 1 organization Canadian Centre for Cyber Security 1 vendor Tenable 1 organization CISA 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.