Reported by 4 outlets
Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.24 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-21962 is a CVSS 10.0 flaw in the Weblogic Server Proxy Plug-in for Apache HTTP Server and for IIS, the front-end components of Oracle Fusion Middleware, affecting Oracle HTTP Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 (the IIS plug-in only at 12.2.1.4.0). Oracle patched it in the January 20, 2026 Critical Patch Update, rating it remotely exploitable over HTTP without authentication. The Cyber Centre recorded a public PoC on January 21, 2026, and CISA added the CVE to the Known Exploited Vulnerabilities catalog on August 24, 2026, confirming exploitation in the wild.
The mechanism deserves more attention than the CVE label suggests. The flaw lives not in WebLogic Server itself but in the proxy plug-ins deployed on separate Apache and IIS web-tier hosts, and Oracle flags changed scope, meaning a compromise at the plug-in layer reaches the additional products those front-ends exist to shield, namely the WebLogic backends behind them. That is the failure mode patch programs miss: teams patch the WebLogic admin and managed servers and overlook the standalone plug-in hosts, which by design sit on the internet-facing tier. The public exploit signal was also noisy from the start, since a GitHub PoC repository for this CVE was publicly accused of shipping fake exploit code on January 22, 2026, yet the August 24 KEV entry settles the exploitation question seven months after the patch. The lesson for the other thirty stories that day is that a dubious PoC and a quiet feed footprint did not mean safe.
Inventory every Apache and IIS host running the WebLogic Server Proxy Plug-in (the mod_wl module on Apache, the iisproxy extension on IIS) and confirm each received the January 2026 CPU or a later patch set for 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0, rather than assuming the WebLogic server patch level covers the tier. Restrict HTTP exposure of front-ends to trusted networks where the business allows it. Hunt in front-end HTTP access logs for unauthenticated request sequences against WebLogic-proxied locations followed by unexpected data creation or modification, since Oracle scores confidentiality and integrity loss at high with no availability impact, and treat any KEV-driven scan spikes against the plug-in endpoints as candidates for review. Federal agencies face BOD 22-01 remediation timelines from the August 24 designation.
Watch for a working public exploit or vendor-exploitation detail replacing the discredited January PoC, which would move this from catalog entry to active campaign, and for further KEV additions or telemetry against sibling vulnerabilities from the January 2026 CPU, since a batch that produced one actively exploited plug-in flaw is a shortlist for attackers.
Timeline
-
original reporting
Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2
malware.news · 50d ago · August 24th, 2026
Serial number: AV26-042 Date: January 21, 2026 Updated: August 24, 2026 On January 20, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Update 1 On January 21, 2026, a proof of concept (PoC) for the vulnerability CVE-2026-21962 became publicly available. CVE-2026-21962 is a vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware which may allow a remote attacker to obtain unauthorized access. Update 2 On August 24, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates. Oracle Critical Patch Update Advisory – January 2026 CISA KEV: CVE-2026-21962 Article Link: Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2 - Canadian Centre for Cyber Security
-
update from oracle.com
Oracle Critical Patch Update Advisory - January 2026
oracle.com · 267d ago · January 20th, 2026
Oracle's January 2026 Critical Patch Update, dated January 20, 2026, lists CVE-2026-21962 in the Oracle Fusion Middleware risk matrix for the Weblogic Server Proxy Plug-in for Apache HTTP Server and for IIS, affecting versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 (IIS plug-in only 12.2.1.4.0). Oracle rates it CVSS 3.1 base 10.0, remotely exploitable over HTTP without authentication, with a changed scope. The modification history shows Rev 2 on January 22, 2026 and Rev 3 on February 2, 2026.
-
update from nvd.nist.gov
NVD record for CVE-2026-21962
nvd.nist.gov · 266d ago · January 20th, 2026
NVD published the CVE-2026-21962 record on January 20, 2026 with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N): an easily exploited, unauthenticated network vector over HTTP with high confidentiality and integrity impact and changed scope. CISA's SSVC decision points in the record mark exploitation as active and automatable with total technical impact. References include the Oracle advisory and a GitHub PoC repository that has since been removed.
-
update from web.archive.org
Archived GitHub issue accusing the CVE-2026-21962 PoC repository of publishing fake exploits
web.archive.org · 265d ago · January 22nd, 2026
A Wayback capture of GitHub issue #1 on the Ashwesker/Ashwesker-CVE-2026-21962 repository, opened January 22, 2026 by Chocapikk, publicly accuses the repo of posting fake PoCs for the CVE. The issue drew more than 35 upvote reactions. This dates the public PoC controversy around the exploit code circulating one day after the Cyber Centre recorded PoC availability on January 21, 2026; the underlying repository now returns 404.