CISA added actively exploited Oracle WebLogic flaw CVE-2026-21962 (CVSS 10.0) to its KEV catalog, letting unauthenticated attackers access or modify critical data.
CISA added CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Oracle shipped patches in January 2026, and GreyNoise, CloudSEK, and SOCRadar have since reported exploitation attempts, including a lone IP scanning multiple WebLogic, Ivanti, GNU InetUtils, and GLPI vulnerabilities. The flaw is also among several exploited by a China-linked actor delivering the SNOWLIGHT downloader to government and commercial infrastructure in more than 100 countries. Federal civilian agencies must apply fixes by August 27, 2026 under BOD 26-04.
CISA added actively exploited CVE-2026-21962, a CVSS 10.0 unauthenticated flaw in Oracle HTTP Server and WebLogic Proxy Plug-in, to KEV with an August 27 deadline.
CISA added CVE-2026-21962 (CVSS 10.0), an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by August 27, 2026. The unauthenticated flaw allows remote attackers with network access to create, delete, or modify critical data, potentially gain broad access, and cause a scope change to other systems; affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CloudSEK honeypot data from January-February 2026 showed widespread exploitation of the flaw alongside older WebLogic RCEs including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271.
CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.
Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.
Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in
CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (components: the plug-in for Apache HTTP Server and the plug-in for IIS), part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can trivially exploit it, and the scope-change designation means a successful attack can significantly impact additional products beyond the plug-in itself. The attacker gains unauthorized access to critical data (potentially all accessible data) as well as the ability to create, delete, or modify critical data, reflected in the maximum CVSS 10.0 score with high confidentiality and integrity impacts and no availability impact. Organizations running the affected versions - 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the Apache plug-in, and 12.2.1.4.0 only for the IIS plug-in - especially those with internet-facing Apache/IIS/OHS front ends proxying WebLogic applications, are exposed. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-24, and EPSS assigns a 42% probability of exploitation within 30 days, though no public proof-of-concept is known.
· Oracle HTTP Server (Oracle Fusion Middleware) 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 · Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 KEVlarge
CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation.
Unauthenticated Remote Code Execution in Oracle WebLogic Server via IIOP
CVE-2020-2551 is a critical flaw in the WLS Core Components of Oracle WebLogic Server that allows an unauthenticated attacker with network access to the IIOP protocol to remotely compromise the server. An attacker sends crafted IIOP requests directly to a listening WebLogic instance and gains takeover of the server, with high impact to confidentiality, integrity, and availability (CVSS 9.8). Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, and 12.2.1.4.0 are affected, spanning widely deployed enterprise and government middleware environments. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2023-11-16, and EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), indicating active and likely broad targeting. Because exploitation requires only network reachability to the IIOP listener and no credentials or user interaction, internet-exposed WebLogic servers are the primary targets.
Unauthenticated Remote Code Execution in Oracle WebLogic Server
Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.
· Oracle WebLogic Server KEV ransomware PoC ×3large
High-Privilege Console Flaw in Oracle WebLogic Server Enables Full Takeover
CVE-2020-14883 is a vulnerability in the Console component of Oracle WebLogic Server that is exploitable over HTTP by a high-privileged attacker with network access; a successful attack results in complete takeover of the WebLogic Server, with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 7.2). Oracle rates it as easily exploitable (low attack complexity, no user interaction required), and public reporting on the actively exploited WebLogic flaws describes unauthenticated attackers accessing critical data, typically because the required privileged console access is first obtained via the related unauthenticated console flaw fixed in the same October 2020 Critical Patch Update. All supported WebLogic versions listed by Oracle are affected - 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 - wherever the administration console is network-reachable. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with applying vendor updates as the required action, EPSS assigns a 97.9% probability of exploitation within 30 days (100th percentile), and public reporting describes malware campaigns against exposed WebLogic servers, including the 8220 gang exploiting older WebLogic flaws to deliver infostealers and cryptominers.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.