U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited CVE-2026-21962, a CVSS 10.0 unauthenticated flaw in Oracle HTTP Server and WebLogic Proxy Plug-in, to KEV with an August 27 deadline.
CISA added CVE-2026-21962 (CVSS 10.0), an improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by August 27, 2026. The unauthenticated flaw allows remote attackers with network access to create, delete, or modify critical data, potentially gain broad access, and cause a scope change to other systems; affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. CloudSEK honeypot data from January-February 2026 showed widespread exploitation of the flaw alongside older WebLogic RCEs including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271.
- CVE-2026-21962 is a maximum-severity, unauthenticated flaw requiring no credentials
- Exploitation gives access to critical data and possible scope change to other systems
- Affects Oracle HTTP Server and WebLogic Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
- CloudSEK honeypots observed exploitation alongside CVE-2020-14882/14883, CVE-2020-2551, CVE-2017-10271
- Federal agencies must patch by August 27, 2026 under BOD 22-01
- Vendors
- Oracle
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server | 7.5 | 100% | KEVRansomwarePoC ×3 | KEV |
CVE-2020-14882+1 related CVE | Remote Code Execution in Oracle WebLogic Server | 9.8 group max | 100% | KEVPoC ×3 | KEV |
| CVE-2020-2551 | Unauthenticated Remote Code Execution in Oracle WebLogic Server via IIOP | 9.8 | 93% | KEV | KEV |
| CVE-2026-21962 | Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in | 10.0 | 73% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle flaw to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.