{"id":"CVE-2026-21962","kind":"vulnerability","aliases":["CVE-2026-21962"],"related":[],"title":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware…","description":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).","summary":"Oracle HTTP Server and the WebLogic Server Proxy Plug-in have an improper access control flaw that lets an unauthenticated or low-privileged attacker create, change, or delete data and read data they should not reach. CISA lists it as actively exploited in the wild, and the sources give no CVSS score.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-08-24T00:00:00+00:00","products":[{"name":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"oracle http server","fixed":[],"affected":"= 12.2.1.4.0","ecosystem":"vendor"},{"name":"oracle http server","fixed":[],"affected":"= 14.1.1.0.0","ecosystem":"vendor"},{"name":"oracle http server","fixed":[],"affected":"= 14.1.2.0.0","ecosystem":"vendor"},{"name":"oracle weblogic server proxy plug-in","fixed":[],"affected":"= 12.2.1.4.0","ecosystem":"vendor"},{"name":"oracle weblogic server proxy plug-in","fixed":[],"affected":"= 14.1.1.0.0","ecosystem":"vendor"},{"name":"oracle weblogic server proxy plug-in","fixed":[],"affected":"= 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","java","oracle-http-server","self-hosted","vendor","weblogic"],"not_affected_if":["no-oracle-http-server","no-weblogic-proxy-plugin"],"how_to_check":"Identify Oracle HTTP Server and WebLogic Proxy Plug-in installs and their versions. Exact affected version ranges: unknown.\nCheck the CISA KEV entry and the Oracle Critical Patch Update advisory for the product versions named.","fix":"Apply the Oracle patch or mitigation for CVE-2026-21962 per Oracle's advisory; the version to move to is unknown from these sources.\nFollow CISA BOD 26-04 guidance; if no mitigation exists, stop using the affected product, per CISA's instruction.","status":"open","published_at":"2026-01-20T22:15:59+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:52+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:31:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle patch or mitigation for CVE-2026-21962 per Oracle's advisory; the version to move to is unknown from these sources.\nFollow CISA BOD 26-04 guidance; if no mitigation exists, stop using the affected product, per CISA's instruction.","summary":"Oracle HTTP Server and the WebLogic Server Proxy Plug-in have an improper access control flaw that lets an unauthenticated or low-privileged attacker create, change, or delete data and read data they should not reach. CISA lists it as actively exploited in the wild, and the sources give no CVSS score.","category":"vendor","who_cares":["oracle-http-server","weblogic","self-hosted","java"],"confidence":0.6,"analyst_note":"Find the Oracle security alert for CVE-2026-21962 to confirm affected versions, the patch version, and any interim mitigation; check whether it needs network exposure or authentication.","how_to_check":"Identify Oracle HTTP Server and WebLogic Proxy Plug-in installs and their versions. Exact affected version ranges: unknown.\nCheck the CISA KEV entry and the Oracle Critical Patch Update advisory for the product versions named.","needs_analyst":true,"not_affected_if":["no-oracle-http-server","no-weblogic-proxy-plugin"],"severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2328,"output_tokens":476,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,23A '-21962':21A,24A '/av':308C '10.0':299C '12.2.1.4.0':174C,293C '14.1.1.0.0':175C '14.1.2.0.0':177C '3.1':296C,307C 'access':91B,186C,237C,253C,259C,265C,278C 'activ':119B 'addit':220C 'affect':172C,281C 'allow':181C 'and':28A 'apach':157C 'attack':102B,183C,216C,225C 'base':297C 'c/c':313C 'chang':104B,223C 'cisa':115B 'complet':264C 'compon':149C 'compromis':190C 'confidenti':300C 'control':92B 'creat':103B 'creation':233C 'critic':239C,261C 'cve':19A,22A 'cvss':129B,295C,304C,306C 'data':107B,110B,240C,254C,262C,279C 'delet':106B,234C 'easili':178C 'exploit':66B,120B,179C 'flaw':93B 'fusion':17A,147C 'give':127B 'h/a':315C 'h/i':314C 'host':74B 'http':5A,26A,37A,40A,43A,70B,78B,135C,158C,188C,192C,207C,244C,269C 'ii':167C,291C 'impact':219C,303C 'improp':90B 'in':35A,51A,58A,65A 'integr':302C 'java':67B 'l/pr':310C 'let':95B 'list':116B 'low':100B 'low-privileg':99B 'may':217C 'middlewar':18A,148C 'modif':236C 'n':316C 'n/ac':309C 'n/s':312C 'n/ui':311C 'network':185C 'note':280C 'oracl':4A,7A,16A,69B,77B,134C,137C,146C,191C,194C,206C,209C,243C,246C,268C,271C 'oracle':25A,29A,36A,39A,42A,45A,52A,59A 'oracle-http-serv':68B 'plug':12A,34A,50A,57A,64A,86B,142C,154C,164C,199C,214C,251C,276C,288C 'plug-in':11A,33A,49A,56A,63A,85B,141C,153C,163C,198C,213C,250C,275C,287C 'privileg':101B 'product':14A,144C,221C 'proxi':10A,84B,140C,152C,162C,197C,212C,249C,274C,286C 'proxy':32A,48A,55A,62A 'reach':114B 'read':109B 'result':230C 'scope':222C 'score':130B,298C 'self':73B 'self-host':72B 'server':6A,9A,27A,31A,38A,41A,44A,47A,54A,61A,71B,79B,83B,136C,139C,151C,159C,161C,193C,196C,208C,211C,245C,248C,270C,273C,285C 'signific':218C 'sourc':126B 'success':224C 'support':168C 'unauthent':97B,182C 'unauthor':232C,258C 'vector':305C 'vendor':75B 'version':169C,282C 'via':187C 'vulner':1A,131C,180C,203C,228C 'weblog':8A,76B,82B,138C,150C,160C,195C,210C,247C,272C,284C 'weblogic':30A,46A,53A,60A 'well':256C 'wild':123B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-20T22:15:59+00:00","kev":{"dateAdded":"2026-08-24","dueDate":"2026-08-27","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-21962","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21962","severity":null,"published_at":"2026-08-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T13:39:28+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-21962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21962","severity":null,"published_at":"2026-01-20T22:15:59+00:00","modified_at":"2026-08-25T04:18:11+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}