CVE-2026-21962: Critical Oracle WebLogic Proxy Plug-in Flaw Exploited in the Wild

CVE-2026-21962 is a maximum-severity access control vulnerability (CVSS 10.0, CWE-284) in Oracle's web proxy software, specifically the Oracle HTTP Server and the WebLogic Server Proxy Plug-in that sits at the network edge and forwards incoming web traffic to backend WebLogic application servers. An attacker on the internet can reach the proxy without any credentials and send specially crafted HTTP requests, and from there read, create, modify, or delete data passing through it. Because the flaw carries a scope change, the impact can extend beyond the proxy to the applications and services behind it.

A key scoping point is that this does not affect every WebLogic deployment, only the proxy plug-in layer used with Apache HTTP Server or Microsoft IIS. The affected versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 for the Apache HTTP Server plug-in variant, and 12.2.1.4.0 only for the IIS variant. This makes it primarily an edge-exposure risk, so checks should focus on internet-facing and DMZ systems running the proxy rather than internal application servers.

The patch preceded any observed exploitation, so this was not a zero-day. However, a public proof-of-concept appeared around January 22, 2026, and honeypot telemetry recorded exploitation attempts almost immediately, with further exploitation reporting through mid-2026. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog only on August 24, 2026, roughly seven months later, with a remediation due date of August 27, 2026 — a notable lag that confirms active exploitation while illustrating that KEV listing trailed the real-world evidence.

Remediation is straightforward but should be treated as a priority. Applying Oracle's January 2026 Critical Patch Update is the only complete fix, and it needs to reach all affected nodes, including failover and non-production systems. Until patching is complete, restrict network access to the affected proxy ports so they are reachable only from trusted sources, and isolate edge proxy hosts from the backend WebLogic clusters they serve.