Reported by 6 outlets
Hackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive Data
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.21 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, specifically the plug-in builds for Apache HTTP Server and for IIS, on versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, with the IIS build limited to 12.2.1.4.0. Oracle fixed it in the January 20, 2026 Critical Patch Update with a CVSS 3.1 score of 10.0 and vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N: reachable over the network, no authentication, no user interaction, scope changed, high confidentiality and integrity impact, no availability impact. On August 24, 2026, CISA added it to the KEV catalog citing active exploitation, with known ransomware campaign use still listed as Unknown.
The plug-in is the web-tier front door that forwards requests from Apache or IIS to WebLogic backends, so a flaw at this layer turns the internet-facing tier into a read and write path against applications administrators believe are shielded from direct access. The impact split matters more than the headline score: with confidentiality and integrity hit but availability untouched, an attacker can quietly create, alter or delete backend business data without ever causing an outage, so tampering may be the only symptom and few teams monitor for it. The seven month gap between the January 20 patch and the August 24 KEV addition is the real story: this is not a zero-day, it is the exploitation of unpatched installs seven months after a fix existed, and CISA flagged the entry for forensic triage, not merely patching.
Apply the January 2026 CPU to every Oracle HTTP Server and proxy plug-in deployment on 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0, and treat any internet-reachable instance that missed it as potentially compromised: run forensics per CISA's triage requirements rather than patching alone, since federal remediation was due August 27, 2026 under BOD 26-04. Where patching lags, enforce that only the fronting proxy tier can reach WebLogic and block external access to plug-in endpoints outright. Hunt in Apache, IIS and Oracle HTTP Server access logs for external source IPs requesting internal-only or administrative URLs through the proxy, and for write methods (PUT, POST, DELETE) on proxied applications returning 2xx. Because the bug tampers rather than crashes, reconcile backend application audit logs for records changed without a matching legitimate session.
Two developments would change this assessment. The KEV ransomware field moving from Unknown to Known, or any actor attribution, would upgrade this from a data-integrity risk to ransomware pre-positioning against the same unpatched estate. And credible public exploit code would matter: the PoCs that surfaced within days of the January patch were publicly called out as fake on GitHub on January 22, 2026, so working exploit code now would convert opportunistic probing into mass scanning of a target list that has had seven months to grow.
Timeline
-
original reporting
Hackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive Data
gbhackers.com · 50d ago · August 25th, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Oracle HTTP Server to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2026-21962, affects both Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. CISA classified this issue as […] The post Hackers Exploit Critical Oracle HTTP Server Flaw to Access and Modify Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from oracle.com
Oracle Critical Patch Update Advisory - January 2026
oracle.com · 266d ago · January 20th, 2026
The January 2026 Critical Patch Update fixes CVE-2026-21962, an improper access control flaw (CWE-284) in the WebLogic Server Proxy Plug-in for Apache HTTP Server and for IIS, affecting Oracle HTTP Server and plug-in versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Oracle rates it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N): remotely exploitable without authentication over HTTP, high confidentiality and integrity impact, no availability impact, scope changed. Advisory notes state the affected version for the IIS plug-in is 12.2.1.4.0 only. The NVD record, sourced from Oracle's security team, was published January 20, 2026.
-
update from github.com
Issue #1 on Ashwesker-CVE-2026-21962: Stop wasting everyone's time with fake PoCs
github.com · 265d ago · January 22nd, 2026
Two days after the January 2026 CPU, user Chocapikk opened this issue accusing another account of flooding GitHub with fake proof-of-concept exploits for CVE-2026-21962. The issue is listed as an issue-tracking reference on the CVE's NVD entry, and an archived copy dated January 29, 2026 confirms the dispute happened within days of the patch release. It documents that the first public exploit code for this CVE was unreliable at best.
-
update from thehackernews.com
Weekly Recap: Firewall Flaws, AI-Built Malware, Browser Traps, Critical CVEs & More
thehackernews.com · 261d ago · January 26th, 2026
The Hacker News listed CVE-2026-21962 among the week's trending CVEs six days after disclosure, linking readers to Oracle's January 2026 CPU alongside the other Fusion Middleware fixes (CVE-2025-66516, CVE-2025-54988, CVE-2025-4949, CVE-2025-54874, CVE-2025-49796, CVE-2025-23048). This is the earliest mainstream coverage found, and it framed the CVE purely as a patch-now item with no exploitation reporting at the time.
-
update from cisa.gov
CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-21962
cisa.gov · 51d ago · August 24th, 2026
CISA added CVE-2026-21962 to the KEV catalog on August 24, 2026, citing evidence of active exploitation, one day before the story's first seen time. The entry sets a federal remediation due date of August 27, 2026 under BOD 26-04, marks forensic triage as required, and lists known ransomware campaign use as Unknown. The required action directs stakeholders to apply vendor mitigations and evaluate each asset's internet exposure.
-
update from cyberpress.org
CISA Warns Oracle HTTP Server Flaw Lets Unauthenticated Attackers Access and Modify Critical Data
cyberpress.org · 49d ago · August 25th, 2026
CISA described it as an improper access control issue that can allow unauthenticated attackers to access and modify critical data without valid credentials. The addition was announced on August 24, 2026, placing the vulnerability among the security flaws that federal agencies must prioritize under Binding Operational Directive (BOD) 26-04. CISA Warns Oracle HTTP Server Flaw Oracle HTTP Server is widely deployed as a web-tier component in enterprise environments, often fronting Oracle WebLogic Server applications and business-critical services. A weakness in the proxy plug-in layer can therefore create a pathway for attackers to interact with backend applications or data stores that administrators may believe are shielded from direct internet access. CVE-2026-21962 is particularly concerning because exploitation does not require authentication. Attackers able to reach a vulnerable endpoint may be able to bypass intended access restrictions, retrieve sensitive information, or alter data handled by affected systems. Depending on deployment architecture and connected applications, the impact could include unauthorized changes to business records, configur