Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2
CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.
Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.
- CVE-2026-21962 added to CISA KEV on August 24, 2026
- Affects Oracle HTTP Server and WebLogic Server Proxy Plug-in
- Remote unauthorized access possible; PoC public since January 2026
- Patched in Oracle's January 2026 quarterly rollup; patching urged
- CVEs
- CVE-2026-21962
- Vendors
- Oracle
- Organizations
- OracleCISACanadian Centre for Cyber Security
- Countries
- CanadaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21962 | Unauthenticated Access Control Bypass in Oracle HTTP Server and WebLogic Proxy Plug-in | 10.0 | 73% | KEV | KEV |
From the original article
Serial number: AV26-042 Date: January 21, 2026 Updated: August 24, 2026 On January 20, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Update 1 On January 21, 2026, a proof of concept (PoC) for the vulnerability CVE-2026-21962 became publicly available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.