What happened
The Cybersecurity and Infrastructure Security Agency added CVE-2026-21962, a vulnerability in the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog on August 24, 2026, confirming that attackers are using the flaw against live systems (CISA, 2026). The agency gave federal civilian agencies until August 27 to complete remediation, a three-day window.
The vulnerability carries a CVSS 3.1 base score of 10.0, the maximum possible rating. It sits in the WebLogic Server Proxy Plug-in for Apache HTTP Server and for Microsoft IIS, including deployments bundled with Oracle HTTP Server, both components of Oracle Fusion Middleware (Oracle, 2026). An unauthenticated attacker with network access over HTTP can bypass the proxy's access controls through path traversal and header manipulation and reach the backend WebLogic Server instance without credentials (CVE.org, 2026).
A CVSS 10.0 score means every scoring factor points toward maximum risk: the flaw is exploitable over the network, requires no authentication, and needs no user interaction. Oracle's own advisory describes the impact as extending beyond the vulnerable component itself, a scope change. A successful attacker can reach unauthorized creation, deletion or modification access to critical data across everything the Oracle HTTP Server and WebLogic Server Proxy Plug-in can touch (Oracle, 2026).
Oracle patched the flaw in its January 2026 Critical Patch Update, on January 20, 2026, more than seven months before CISA's catalog addition (Oracle, 2026).
Who is affected
The flaw affects organizations running Oracle HTTP Server or the WebLogic Server Proxy Plug-in in front of a WebLogic Server cluster. Oracle's advisory lists the affected versions as 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for the Apache-based plug-in, and 12.2.1.4.0 for the IIS-hosted version (Oracle, 2026).
These proxy components typically sit at the network edge, in front of internal WebLogic clusters running business applications. Researchers at NetSPI note that because the plug-in usually sits in a DMZ, exposure runs broader than for a purely internal WebLogic bug, since the proxy layer forwards HTTP traffic straight into the WebLogic cluster behind it (NetSPI, 2026).
The plug-in itself is a routing component. It decides which HTTP requests get forwarded from the web server to the WebLogic application layer behind it. A flaw in that routing logic that lets an attacker skip authentication checks does not just expose the proxy, it exposes whatever the proxy was built to sit in front of.
CISA's catalog addition creates a binding deadline for federal civilian executive branch agencies under existing CISA remediation policy. Private-sector organizations running the affected components are not bound by that deadline. CISA only adds a CVE to the catalog once it has confirmed evidence of exploitation in the wild, which is true regardless of who operates the system (CISA, 2026).
The timeline
The gap between patch and exploitation confirmation is unusual mainly for how quickly attackers moved, not how long the KEV addition took. A public proof-of-concept was available within a day of the patch: the Canadian Centre for Cyber Security reported a working PoC circulating on January 21, 2026 (Canadian Centre for Cyber Security, 2026). By January 28, the SANS Internet Storm Center was logging inbound requests against WebLogic paths with the malformed traversal sequences and injected headers characteristic of CVE-2026-21962 exploitation attempts (SANS ISC, 2026). CISA's confirmation in August means the flaw was likely being probed, and in some cases exploited, for months before the catalog entry made that fact official.
CISA's advisory does not name affected organizations or attribute the exploitation activity to any specific actor, and none of that detail appears in this post.
What affected organizations should know
Any organization running an affected Oracle HTTP Server or WebLogic Server Proxy Plug-in deployment that has not applied the January 2026 Critical Patch Update has had an unauthenticated, maximum-severity flaw sitting at its network edge since January.
Security teams should confirm the patch is applied, then check WebLogic and proxy access logs going back to late January. Look for the request patterns described in the SANS ISC report: path traversal sequences and manipulated headers aimed at the proxy layer. Organizations that cannot patch immediately should at minimum restrict inbound access to the proxy layer to trusted networks and monitor for those patterns, though that is a stopgap and not a substitute for applying Oracle's fix.
Given how early probing activity began, a system that has been internet-facing and unpatched since January should be treated as potentially compromised rather than simply vulnerable, and reviewed accordingly before it is considered clean.
What happens next
CISA's August 27 deadline binds only federal civilian agencies, but a KEV catalog listing carries weight beyond that. Cyber insurance underwriting and vendor risk questionnaires increasingly ask directly about an organization's exposure to CISA's catalog, which gives the listing consequences that extend past the federal deadline itself.
CISA created the KEV catalog under its Binding Operational Directive 22-01. It functions differently from a routine vulnerability list: entry requires confirmed exploitation, not just theoretical risk. That is why security teams outside government tend to treat a KEV listing as a stronger signal than a CVSS score alone. Not every maximum-severity vulnerability makes the catalog. This one did seven months after the patch was already available, which says more about the pace of patching across affected environments than about the pace of Oracle's original response.
Oracle's next scheduled Critical Patch Update is due in October 2026, following the company's standard quarterly cadence. No further Oracle guidance specific to CVE-2026-21962 has been published beyond the January 2026 fix and the mitigation advice already in that advisory.
Sources
Cybersecurity and Infrastructure Security Agency. "CISA Adds One Known Exploited Vulnerability to Catalog." August 24, 2026. https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog
Cybersecurity and Infrastructure Security Agency. "Known Exploited Vulnerabilities Catalog: CVE-2026-21962." 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962
Oracle. "Critical Patch Update Advisory: January 2026." 2026. https://www.oracle.com/security-alerts/cpujan2026.html
CVE.org. "CVE Record: CVE-2026-21962." 2026. https://www.cve.org/CVERecord?id=CVE-2026-21962
NetSPI. "Oracle WebLogic Server Proxy Plugin (CVE-2026-21962): Overview & Takeaways." 2026. https://www.netspi.com/blog/executive-blog/critical-vulnerability/oracle-weblogic-server-proxy-plugin-cve-2026-21962-overview-takeaways/
SecurityWeek. "CISA Warns of Exploited Oracle WebLogic Vulnerability." August 2026. https://www.securityweek.com/cisa-warns-of-exploited-oracle-weblogic-vulnerability/
Field Effect. "Public PoC and Probing Reported for Max-Severity Oracle Proxy Flaw." 2026. https://fieldeffect.com/blog/poc-maximum-severity-oracle-proxy
Canadian Centre for Cyber Security. "Oracle Security Advisory: January 2026 Quarterly Rollup (AV26-042)." 2026. https://www.cyber.gc.ca/en/alerts-advisories/oracle-security-advisory-january-2026-quarterly-rollup-av26-042