CVE-2026-21962: Oracle HTTP Server and WebLogic Proxy Plug-in Access Control Flaw Actively Exploited

CVE-2026-21962 is classified as an improper access control vulnerability (the CVSS vector published for it is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, meaning network-reachable, low attack complexity, no privileges or user interaction required, a changed scope, and high confidentiality and integrity impact with no availability impact). In plain terms, the flaw sits in how the WebLogic Server Proxy Plug-in, the module that forwards HTTP requests from a front-end web server into a backend WebLogic cluster, evaluates whether a given request should be allowed through. An attacker who sends a specially structured request can get the plug-in to skip the access check it would normally apply, landing on backend resources or data it should never expose to an unauthenticated caller.

The affected surface is broader than a single deployment pattern. It covers the WebLogic Server Proxy Plug-in for Apache HTTP Server and for Microsoft IIS as standalone installs, and it also covers Oracle HTTP Server itself, since Oracle HTTP Server bundles this same proxy plug-in functionality out of the box. Affected versions span Oracle HTTP Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, and WebLogic Server Proxy Plug-in for Apache 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, plus the Proxy Plug-in for Microsoft IIS at 12.2.1.4.0. If your environment runs Oracle HTTP Server at all, you are in scope for this advisory regardless of whether you separately deployed the plug-in against a third-party Apache or IIS instance.

The scope-changed designation in the CVSS vector matters operationally: a successful exploit does not stay contained to the proxy component itself. It can extend into whatever the proxy fronts, which in most Oracle Fusion Middleware deployments means the WebLogic-hosted application tier and the data it serves.

Oracle HTTP Server and WebLogic have a well-documented history of pre-authentication vulnerabilities that attackers weaponize quickly once details become public. CVE-2020-14750 and CVE-2019-2725 were both pre-auth remote code execution flaws in the WebLogic stack, and CVE-2020-14882, an authentication bypass into the WebLogic Administration Console, is covered in detail in our own writeup of CVE-2020-14882 and the WebLogic console RCE chain. That history is relevant background, not proof that CVE-2026-21962 shares the same root cause. CVE-2020-14882 was a URL-parsing bypass into an administrative console; CVE-2026-21962 is an access control failure in the proxy layer that forwards requests to the backend in the first place. They are different bugs in different components of the same product family. What they share is the pattern: an internet-facing Oracle web or application-server component with an access control weakness that gets exploited within a short window of public disclosure.

Oracle's stack is not the only vendor in this category. We have covered a comparable pattern of Oracle PeopleSoft edge exposure in our analysis of CVE-2026-35273 and the PeopleSoft PSEMHUB zero-day, and the threat-actor behavior that tends to follow this kind of Oracle-specific access control failure is documented in our ShinyHunters APT profile on Oracle PeopleSoft targeting. Neither of those posts establishes attribution for CVE-2026-21962 specifically, and we do not draw that line here; they are offered as pattern context for how quickly Oracle's internet-facing middleware tends to attract exploitation once a flaw of this class becomes known.

CVE-2026-21962 clears a bar this platform treats as meaningfully stronger than a single-source claim: it is corroborated by two independent, distinct sources. CISA added it to the Known Exploited Vulnerabilities catalog on August 24, 2026, and CISA separately published a dedicated advisory on the same vulnerability. A KEV listing and a standalone CISA advisory are produced through different processes at CISA, and having both on the same CVE is a materially stronger signal of active, real-world exploitation than a KEV entry alone.

What this dual listing does not do is name a threat actor. We reviewed several independent write-ups on this vulnerability while preparing this advisory, and they do not agree on attribution. At least one report references China-nexus activity and malware tooling in connection with broader WebLogic exploitation trends, but other independent technical write-ups on this specific CVE explicitly state that no confirmed threat actor or campaign has been publicly tied to it, and that a KEV listing by itself does not disclose who is behind the exploitation. Given that disagreement, we are not naming an actor in this advisory. Treat any specific actor or campaign name you see attached to CVE-2026-21962 elsewhere as provisional until it is confirmed by more than one independent technical source, and recheck CISA's own advisory page directly, since attribution details are exactly the kind of content that gets added or corrected after a KEV entry's initial publication.

This platform's paid Action Panel for CVE-2026-21962 carries vendor-verified Prevent content (Oracle's own patch advisory) and Respond content (a guided incident-response runbook), both generated specifically for this threat. Detect and Hunt content is also available, translated into vendor-specific variants for Splunk, Elastic, Microsoft Sentinel and Defender, CrowdStrike, SentinelOne, Cortex XDR, QRadar, and Chronicle, alongside the underlying Sigma rule and retrospective hunt queries, though this detection content is system-drafted rather than a hand-verified, vendor-confirmed query written against this exact vulnerability, so treat it as a starting point and adapt it to your own environment before relying on it operationally.

Start by confirming your actual deployed version against the affected list: Oracle HTTP Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, and WebLogic Server Proxy Plug-in for Apache at the same three version numbers, plus the Proxy Plug-in for Microsoft IIS at 12.2.1.4.0. A version number that looks recent within its own branch is not the same as being patched, since Oracle ships fixes as branch-specific Critical Patch Update releases rather than a single universal build.

Second, because Oracle's fix for this vulnerability shipped in the January 2026 Critical Patch Update, well before CISA's August 24, 2026 KEV listing, treat any affected instance that has been internet-facing and unpatched since January 2026 as a candidate for prior compromise, not simply a candidate for patching now. That is a seven-month window in which an unpatched, internet-reachable instance would have been exposed to this exact flaw before it was confirmed under active exploitation, and exploitation activity does not necessarily start only after a KEV listing. Pull available web server and application logs covering that window if you can, and treat their absence as a gap to note rather than a clean bill of health.

This platform's threat library carries confirmed, vendor-authored Prevent and Respond content for CVE-2026-21962, generated specifically for this threat rather than pulled from a generic template. Detect and Hunt content remains at the platform's general Sigma-matched tier for this CVE, as noted above, so remediation right now should lean on patching and log review rather than on a CVE-specific detection signature that does not yet exist in verified form.

The most consequential gap in this advisory is the long window between patch availability and confirmed active exploitation, not a lack of source corroboration. Oracle fixed CVE-2026-21962 in its January 2026 Critical Patch Update, and CISA did not add it to the KEV catalog until August 24, 2026, roughly seven months later. That gap means a patch has been publicly available for a long time before this reached confirmed-exploited status, so do not assume exploitation only began recently just because the KEV listing is recent. Re-check your patch history against the January 2026 CPU date specifically, not just against the KEV listing date.

A second, separate limitation is attribution. This CVE is corroborated by two independent government sources, the KEV catalog and a standalone CISA advisory, which is stronger sourcing than many entries in this platform's library carry. But the sources we reviewed do not agree on who is behind the exploitation, and we found no attribution that reached this platform's confirmation bar across independent write-ups. Do not treat any specific actor name attached to this CVE elsewhere as settled; verify it against more than one independent technical source before repeating it.

A third limitation is detection maturity. This platform's Prevent and Respond content for CVE-2026-21962 is vendor-verified, but the Detect and Hunt content covered above is system-drafted per vendor rather than independently vetted against a confirmed exploit sample. If you rely on it in production, verify field names and behavior against your own environment first, since that content has not yet reached the same verification tier as the patch and response guidance above. For the structural fix to a detection gap like this one, see our guide on CVE-2020-14882 and how WebLogic console access control failures get exploited, which documents how detection content for this product family has historically lagged patch guidance.