CVE-2026-21962: Oracle HTTP Server / WebLogic Proxy Plug-in Improper Access Control (KEV)

CVE-2026-21962 is an improper access control vulnerability (CVSS 10.0, Oracle's own rating) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in that lets a remote, unauthenticated attacker over HTTP reach functionality that should require authentication, leading to unauthorized creation, deletion or modification of critical data, and CISA added it to KEV with one of its shortest remediation windows (three days) because of active exploitation.

CVE-2026-21962 is an improper access control vulnerability (CWE-284) affecting the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in product of Oracle Fusion Middleware. NVD's description states: "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0" (NVD). The plug-in sits in front of WebLogic application servers to route and filter requests, so a flaw in its own access control lets an attacker reach or alter data the plug-in is supposed to gatekeep.

NVD's vulnerability status is Analyzed, but the only CVSS metric on file is the reporting Oracle CNA's own Secondary score: CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — network-reachable, low attack complexity, no privileges or user interaction required, changed scope, high confidentiality and integrity impact with no availability impact. NVD has not published an independent Primary score, so the maximum-severity rating shown here is Oracle's own CNA assessment, not an NVD-confirmed figure (NVD).

Oracle's January 2026 Critical Patch Update risk matrix lists CVE-2026-21962 under Oracle Fusion Middleware, component "Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS," protocol HTTP, with "Remote Exploit without Authentication" marked "Yes" and a CVSS base score of 10.0, affecting supported versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. A footnote on that entry ("Note 1") clarifies: "Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only," and that this IIS variant "Applies to LINUX only" (Oracle Critical Patch Update January 2026).

CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-24, with a required-action due date of 2026-08-27 — a three-day window CISA reserves for flaws under active, high-urgency exploitation — and the catalog records known ransomware campaign use as "Unknown" while flagging that forensic triage is required for any affected, internet-exposed instance. CISA's structured decision record (SSVC) embedded in the NVD entry marks exploitation as "active," the flaw as "automatable," and its technical impact as "total" (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.7319 (99th percentile) — among the highest EPSS scores FIRST tracks, consistent with CISA's unusually short remediation window and "total" SSVC technical-impact rating (FIRST EPSS).

Because the flaw is remotely exploitable over plain HTTP without any authentication, and because CISA's own exploitation signal (active, automatable, total impact) and FIRST's 99th-percentile EPSS both point to serious ongoing abuse, any Oracle HTTP Server or WebLogic Server Proxy Plug-in deployment on 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 should be patched with the January 2026 Critical Patch Update immediately, and administrators should assume internet-facing instances may already have been probed or compromised given the three-day KEV deadline CISA assigned.

• Vulnerability in Oracle HTTP Server / Oracle WebLogic Server Proxy Plug-in (component: plug-in for Apache HTTP Server and for IIS), affecting supported versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. — NVD
• NVD vulnStatus is Analyzed; the only CVSS metric is Oracle's own Secondary CVSS v3.1 score of 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N; no NVD Primary score published. — NVD
• Oracle's January 2026 CPU risk matrix lists this CVE as remotely exploitable without authentication, CVSS 10.0, affecting 12.2.1.4.0/14.1.1.0.0/14.1.2.0.0, with a footnote that the IIS plug-in variant is affected only in 12.2.1.4.0 and only on Linux. — Oracle Critical Patch Update January 2026
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-24, required-action due date 2026-08-27, ransomware campaign use listed as Unknown, forensic triage required; CISA SSVC record marks exploitation active, automatable, technical impact total. — CISA KEV
• EPSS score is 0.7319 (99th percentile) as of 2026-10-28. — FIRST EPSS