CVE-2026-21962
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Description
CVE-2026-21962 is a maximum-severity improper access control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, part of Oracle Fusion Middleware. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise the affected component, and explicitly notes that attacks may significantly impact additional products — the scope change that pushes the CVSS 3.1 base score to the maximum of 10.0. Successful exploitation grants unauthorized creation, deletion or modification of critical data as well as complete read access to all data the component can reach. Supported versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 are affected, with the IIS plug-in affected only in 12.2.1.4.0. CVE-2026-21962 has an EPSS score of roughly 42% at the 98th percentile and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | http server | 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0 |
| oracle | weblogic server proxy plug-in | 12.2.1.4.0; 14.1.1.0.0; 14.1.2.0.0 |
References
- https://www.oracle.com/security-alerts/cpujan2026.html(Patch, Vendor Advisory)
- https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1(Broken Link, Not Applicable)
- https://web.archive.org/web/20260129165916/https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962(US Government Resource)
- https://x.com/0xacb/status/2015473216844620280(Not Applicable)
Weakness Type
CWE-284: Improper Access Control
Improper access control occurs when software does not properly restrict access to a resource from an unauthorized actor — a broad category covering authentication bypass, authorization bypass and failures to enforce access policy. In CVE-2026-21962 the Oracle HTTP Server and WebLogic Server Proxy Plug-in do not adequately restrict what an unauthenticated HTTP client may reach, so a remote attacker without credentials obtains read and write access to data the component is responsible for protecting.
Learn more: CWE-284 — Improper Access Control
Impact Analysis
CVE-2026-21962 reaches the maximum CVSS 3.1 base score of 10.0 because it is remotely exploitable over HTTP with low attack complexity, no authentication, no user interaction, and a CHANGED scope — Oracle states directly that attacks may significantly impact additional products beyond the vulnerable component. Confidentiality and integrity impacts are both High while availability is unaffected: an attacker obtains complete access to all data reachable through the component and can create, delete or modify critical data, but does not gain a direct denial-of-service capability. The scope change is the decisive factor, and it follows from what the component is: a proxy plug-in sits in front of WebLogic application servers and holds the trust relationship that lets requests reach them, so compromising the plug-in means reaching the applications and data behind it. The EPSS score of approximately 42% in the 98th percentile is exceptionally high and indicates sustained mass exploitation; CISA's KEV listing set a remediation deadline of 27 August 2026 that has already passed.
Exploit Maturity
CVE-2026-21962 shows very strong exploitation signals. CISA has confirmed active exploitation through its Known Exploited Vulnerabilities listing, with a remediation deadline of 27 August 2026 that has already passed. The EPSS score of roughly 42%, in the 98th percentile, is among the highest currently assigned and indicates that exploitation attempts against exposed Oracle HTTP Server instances are effectively continuous rather than sporadic. Public discussion of the vulnerability exists in the references, including an archived GitHub issue captured via the Wayback Machine — the archived capture is the appropriate link, as the original may no longer be reachable. Oracle's Critical Patch Update is the only vendor source and, as usual for Oracle, contains no technical detail. Given an unauthenticated flaw in a web-tier component that fronts enterprise application servers, any internet-reachable unpatched instance should be assumed compromised and triaged rather than merely patched.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with Oracle's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 27 August 2026 has passed, so unpatched systems are well overdue.
- Apply the fix from Oracle's Critical Patch Update of January 2026. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 for Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache HTTP Server; the plug-in for IIS is affected only in 12.2.1.4.0. Oracle CPU patches are cumulative, so applying the January 2026 CPU or a later one is the correct action.
- Restrict HTTP access to the proxy tier now. Because the attack arrives over HTTP without credentials, placing the affected servers behind an authenticating reverse proxy, WAF or network allowlist limits who can reach the vulnerable path while patching proceeds — necessary given that the remediation deadline has already expired.
- Assume compromise and investigate the WebLogic tier as well. The scope change means the blast radius extends beyond the plug-in: review HTTP server access logs for anomalous requests preceding the patch, inspect WebLogic domains for unexpected deployments, data source changes and new administrative users, verify application data integrity against backups, and check the hosts for web shells, unfamiliar processes and outbound connections.
- Rotate credentials and harden access control long term. Change WebLogic administrative credentials, rotate data source and integration credentials reachable from the affected servers and replace TLS keys if compromise cannot be excluded; then apply the general defences for this weakness class — deny by default and require explicit grants, centralise access control decisions rather than duplicating checks across components, and keep Fusion Middleware on Oracle's quarterly CPU cadence, since these products are patched only through that channel.
Technical Details
CVE-2026-21962 is an improper access control flaw (CWE-284) in the WebLogic Server Proxy Plug-in for Apache HTTP Server and for IIS, shipped as part of Oracle HTTP Server and Oracle Fusion Middleware. The plug-in's role is to receive HTTP requests at the web tier and forward them to WebLogic application servers, which means it operates at a trust boundary and holds the connectivity that lets external requests reach internal application infrastructure. The defect is that access to the component is not properly restricted for unauthenticated network clients, so an attacker who can send HTTP requests obtains unauthorized read access to all data the plug-in can reach and the ability to create, delete or modify critical data. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N encodes exactly Oracle's own characterisation — network-reachable, low complexity, no privileges, no interaction, changed scope, high confidentiality and integrity impact, no availability impact — and the scope change alone is what lifts a score that would otherwise be 9.1 to the 10.0 ceiling, reflecting Oracle's statement that additional products may be significantly affected.
Frequently Asked Questions
Is CVE-2026-21962 being actively exploited?
Yes. CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog with a remediation due date of 27 August 2026 that has now passed, and its EPSS score of about 42% places it in the 98th percentile — among the highest exploitation probabilities currently tracked, indicating sustained attack activity against exposed instances.
What products are affected by CVE-2026-21962?
Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in are affected in supported versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. The WebLogic Server Proxy Plug-in for IIS is affected only in version 12.2.1.4.0, while the plug-in for Apache HTTP Server is affected across all three.
How do I fix CVE-2026-21962?
Apply the patch from Oracle's Critical Patch Update of January 2026, or a later cumulative CPU, to Oracle HTTP Server and the WebLogic Server Proxy Plug-in. Because the deadline has passed and the flaw is unauthenticated, also restrict HTTP access to the proxy tier, investigate the WebLogic environment behind it for unauthorised changes, and rotate administrative and data source credentials.
How severe is CVE-2026-21962?
It is Critical, with the maximum CVSS 3.1 base score of 10.0. The vulnerability is unauthenticated, exploitable over HTTP with low complexity and no user interaction, and crosses a security scope boundary — Oracle states that attacks may significantly impact additional products — granting complete read access and the ability to create, delete or modify critical data, though without direct availability impact.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.