NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Oracle HTTP Server and WebLogic Proxy Plug-in access-control flaw CVE-2026-21962 exploited; patches available

Attackers are exploiting CVE-2026-21962 in Oracle HTTP Server and WebLogic Server Proxy Plug-in to access or alter data without signing in. Business IT teams should apply Oracle's January 2026 security fix and check exposed systems for compromise.

What to do

There is no update to install on ordinary family devices. If your business or family office runs these Oracle products, ask its IT provider to apply the January 2026 Critical Patch Update fix for CVE-2026-21962 using Oracle's instructions for the installed release, and check internet-facing systems for signs of compromise.

What’s happening

CVE-2026-21962 affects Oracle HTTP Server and the WebLogic Server Proxy Plug-in components for Apache HTTP Server and Microsoft IIS. An attacker who can reach the affected service over HTTP or HTTPS needs no account or user interaction to access, create, change or delete data available through it. Oracle rates the flaw critical, with a CVSS score of 10.0, and says other products can also be affected by a successful attack. Oracle released the fix in its January 2026 Critical Patch Update. CISA confirmed exploitation by listing it on 24 August. As of 3 November, the reviewed sources establish neither the first attack date nor the number of organisations compromised. No later vendor notice withdrawing or declaring the fix incomplete was found.

What
Flaw
Affects
Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in
Affected
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0
Weblogic Server Proxy Plug-in for IIS: 12.2.1.4.0 only
Fixed in
Oracle January 2026 Critical Patch Update security patches for CVE-2026-21962; the public advisory does not specify individual fixed build numbers.
CVE
CVE-2026-21962
Since
24 Aug 2026
Closed
24 Aug 2026

Timeline

  1. CISA added

    CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalogue, confirming use in real attacks. Canada's Cyber Centre updated its warning the same day.

  2. Update

    Canada's Cyber Centre reported that public demonstration code had become available and urged administrators to apply the updates.

  3. New fixFixed

    Oracle disclosed CVE-2026-21962 and addressed it in its January Critical Patch Update. It listed affected releases 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0; the IIS plug-in is affected only in 12.2.1.4.0.

Sources

  1. Oracle Critical Patch Update Advisory - January 2026Oracle · 20 Jan 2026
  2. Text Form of Oracle CPU January 2026 Risk MatricesOracle · 20 Jan 2026
  3. Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2Canadian Centre for Cyber Security · 24 Aug 2026
  4. CISA adds Oracle WebLogic bug to its list of exploited vulnerabilitiesSC Media · 25 Aug 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS