---
id: "CVE-2026-21962"
kind: "vulnerability"
aliases: ["CVE-2026-21962"]
title: "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "oracle http server", "fixed": [], "affected": "= 12.2.1.4.0", "ecosystem": "vendor"}, {"name": "oracle http server", "fixed": [], "affected": "= 14.1.1.0.0", "ecosystem": "vendor"}, {"name": "oracle http server", "fixed": [], "affected": "= 14.1.2.0.0", "ecosystem": "vendor"}, {"name": "oracle weblogic server proxy plug-in", "fixed": [], "affected": "= 12.2.1.4.0", "ecosystem": "vendor"}, {"name": "oracle weblogic server proxy plug-in", "fixed": [], "affected": "= 14.1.1.0.0", "ecosystem": "vendor"}, {"name": "oracle weblogic server proxy plug-in", "fixed": [], "affected": "= 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "oracle-http-server", "self-hosted", "vendor", "weblogic"]
not_affected_if: ["no-oracle-http-server", "no-weblogic-proxy-plugin"]
published_at: "2026-01-20T22:15:59+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21962", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21962", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware…

Oracle HTTP Server and the WebLogic Server Proxy Plug-in have an improper access control flaw that lets an unauthenticated or low-privileged attacker create, change, or delete data and read data they should not reach. CISA lists it as actively exploited in the wild, and the sources give no CVSS score.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in affected ? fixed ?
- vendor:oracle http server affected = 12.2.1.4.0 fixed ?
- vendor:oracle http server affected = 14.1.1.0.0 fixed ?
- vendor:oracle http server affected = 14.1.2.0.0 fixed ?
- vendor:oracle weblogic server proxy plug-in affected = 12.2.1.4.0 fixed ?
- vendor:oracle weblogic server proxy plug-in affected = 14.1.1.0.0 fixed ?
- vendor:oracle weblogic server proxy plug-in affected = 14.1.2.0.0 fixed ?

## How to check

Identify Oracle HTTP Server and WebLogic Proxy Plug-in installs and their versions. Exact affected version ranges: unknown.
Check the CISA KEV entry and the Oracle Critical Patch Update advisory for the product versions named.

## Fix

Apply the Oracle patch or mitigation for CVE-2026-21962 per Oracle's advisory; the version to move to is unknown from these sources.
Follow CISA BOD 26-04 guidance; if no mitigation exists, stop using the affected product, per CISA's instruction.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21962
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21962

## From the sources

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_