Actively Exploited Oracle WebLogic and HTTP Server Flaw Enables Full Compromise
Active Exploitation · 12 sources · Updated 3mo ago · First seen Aug 25, 2026
CISA has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog after confirming active attacks against Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. The maximum-severity flaw, rated CVSS 10.0, affects versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, and can be exploited by unauthenticated attackers over HTTP to compromise exposed systems, including unauthorized access to and modification of critical data. Public reporting describes the issue as a URI normalization path traversal bug that may also enable privilege escalation and execution of injected code through crafted requests.
Oracle issued patches in its January 2026 Critical Patch Update, but reporting from GreyNoise and CloudSEK indicated exploitation in the wild, prompting CISA to order Federal Civilian Executive Branch agencies to remediate by August 27, 2026 under Binding Operational Directive 26-04. Because CISA did not publish indicators of compromise, defenders are being urged to patch immediately and to treat internet-facing Oracle WebLogic and HTTP Server deployments as potentially compromised until proven otherwise.
