Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-21962 10.0
Oracle · HTTP Server and Oracle Weblogic Server Proxy Plug-in · Added 2026-08-24 · Published 2026-01-20
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityOracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
VendorOracle
ProductHTTP Server and Oracle Weblogic Server Proxy Plug-in
Date added2026-08-24
Due date2026-08-27
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-284
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Descriptions

KEV: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.

NVD: Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-25 02:30 UTC
Searches5
Component defaultunknown
Sources https://www.oracle.com/security-alerts/cpujan2026.html
https://www.oracle.com/security-alerts/cve_2026_21962.html
https://www.netspi.com/blog/executive-blog/critical-vulnerability/oracle-weblogic-server-proxy-plugin-cve-2026-21962-overview-takeaways/
https://blog.gridinsoft.com/cve-2026-21962-oracle-http-weblogic-proxy/
https://github.com/George0Papasotiriou/CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-
https://github.com/samael0x4/CVE-2026-21962
https://github.com/naozibuhao/CVE-2026-21962_Java_GUI_Exploit_Tool
https://www.sentinelone.com/vulnerability-database/cve-2026-21962/

Hunting hypothesis agent

Hunt access and WAF logs on OHS/mod_wl_ohs and IIS plug-in front-ends for /bea_wls_internal/ProxyServlet and ..;/ paths, and wl-proxy-client-ip or x-forwarded-for values matching an IP;base64 pattern.

Research details

ComponentWeblogic Server Proxy Plug-in for Apache HTTP Server (mod_wl), Weblogic Server Proxy Plug-in for IIS
PreconditionsUnauthenticated remote attacker with HTTP network access to an Oracle HTTP Server instance or WebLogic Server Proxy Plug-in endpoint. Affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0. No authentication or user interaction required. Proxy plug-in must be actively installed and forwarding traffic to a backend WebLogic server. agent
DeliveryUnauthenticated GET to proxy plug-in endpoints: probe paths /bea_wls_internal/ProxyServlet, /weblogic//weblogic/..;/, /ws_utc/..;/ ; exploit sends wl-proxy-client-ip (also proxy-client-ip / x-forwarded-for) set to {spoofed-IP};{base64 command} (per public PoC built on observed IOCs). Header-reflection in the response is a strong compromise sign.
Public PoCyes
PoC URLs https://github.com/George0Papasotiriou/CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-
https://github.com/naozibuhao/CVE-2026-21962_Java_GUI_Exploit_Tool
https://github.com/samael0x4/CVE-2026-21962 Third-party repos; verify before use.
Advisoryhttps://www.oracle.com/security-alerts/cpujan2026.html
Exploit notesCVSS attack complexity: LOW. Multiple public PoC repositories available (detection toolkit with Nuclei template, Python scanner, Java GUI exploit tool). Exploitation confirmed active by CISA as of August 24, 2026. CRITICAL severity (CVSS 10.0).
SummaryCritical improper access control (CVSS 10/10) in Oracle HTTP Server and WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS, allowing unauthenticated remote HTTP attackers to bypass security controls and gain unauthorized read or write access to backend WebLogic server data. Oracle disclosed it in the January 2026 CPU, and CISA confirmed active exploitation, adding it to KEV on August 24 2026 with a remediation deadline of August 27. Multiple public PoC repositories are available.

Tia coverage

First reported2026-08-24

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

hackers-exploit-critical-oracle-http-server-flaw-to-access-and-moracle-security-advisory-january-2026-quarterly-rollup-av26-042

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub