Attackers Rapidly Weaponize Oracle WebLogic RCE CVE-2026-21962
Active Exploitation · 2 sources · Updated 4mo ago · First seen Mar 25, 2026
Attackers began exploiting Oracle WebLogic Server vulnerability CVE-2026-21962 almost immediately after public proof-of-concept code was posted, according to observations from a high-interaction honeypot emulating an unpatched WebLogic Server 14.1.1.0.0 instance. The flaw is a CVSS 10.0 unauthenticated remote code execution issue in the WebLogic Console, and researchers recorded active exploitation attempts over a 12-day period, showing how quickly newly disclosed enterprise software vulnerabilities can be operationalized.
The activity was largely automated and opportunistic, with scans and exploit attempts originating mainly from rented VPS infrastructure including DigitalOcean and HOSTGLOBAL.PLUS. Researchers also observed continued abuse of older WebLogic flaws such as CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, and CVE-2017-10271, alongside probes for unrelated weaknesses in Hikvision devices and PHPUnit, indicating a broad spray-and-pray campaign. Common tooling included libredtail-http and the Nmap Scripting Engine, while defenders were urged to apply Oracle patches, restrict internet exposure of the administrative console, deploy a WAF, and monitor for suspicious activity including wget or curl execution.
