Oracle HTTP Server

CVE-2026-21962: an unauthenticated request bypasses access control in the Oracle WebLogic Server Proxy Plug-in, CISA KEV-listed on 24 August with exploitation running since January

CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on 2026-08-24, with a CVSS 3.1 base score of 10.0. The flaw is in the request-handling logic of the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS, and in Oracle HTTP Server, which bundles the same component. It is reachable over HTTP with no authentication, no privileges and no user interaction, and it yields unauthorized read and write access to the data the proxy handles plus a route into the backend WebLogic clusters the proxy fronts: "this vulnerability allows an unauthenticated remote attacker to bypass security controls and potentially gain unauthorized access to backend WebLogic systems. Because these proxy plugins often sit in DMZ environments, the exposure is significant" (NetSPI, 2026-01-22).

That last point is the whole finding. The proxy plug-in is not an application server; it is the component an estate deploys specifically to be the trusted boundary in front of one, which means the flaw does not sit behind the perimeter, it is the perimeter. Confirmed affected: Oracle HTTP Server and its proxy plug-in at 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, and the WebLogic Server Proxy Plug-in for Microsoft IIS at 12.2.1.4.0 (same source). Oracle shipped the fix in its January 2026 Critical Patch Update.

Exploitation is not new, only the listing is. CloudSEK's honeypots recorded exploitation attempts from 22 January 2026, immediately after a public proof-of-concept appeared, and CISA has not said what prompted the August listing: "the vulnerability has been exploited since January", and "it’s unclear which attacks triggered CISA’s alert for CVE-2026-21962" (SecurityWeek, 2026-08-25). For a defender that inverts the usual reading of a KEV addition: this is not a newly weaponised flaw to get ahead of, it is confirmation that anything still unpatched has been reachable by a public exploit for seven months.

There is a targeting signal, and it is worth stating precisely, because it is one vendor's characterisation of a different dataset rather than an authority's account of this exploitation. SOCRadar's July analysis of an exposed staging server belonging to a China-nexus operator tracked as UNC5174 and UNC6586, associated with the SNOWLIGHT malware family, lists CVE-2026-21962 among the vulnerabilities weaponised in a campaign whose reconnaissance list SOCRadar says resolved overwhelmingly to government domains across more than a hundred countries (SOCRadar, 2026-07-31). SOCRadar's victimology table is more specific than that summary suggests, and it cuts both ways: against 119 raw list entries and 91 unique hosts for the WebLogic-class campaign, it records exactly one confirmed compromise, with the confirmation method given as "Blind RCE via DNS/HTTP out-of-band callback" (same report). So this operator did use the exploit and got in once that SOCRadar can prove, on a target list that is overwhelmingly governmental, but it converted only about one host in ninety, against 80 of 80 for the same operator's Confluence campaign in that table. The cPanel campaign sits at a comparable per-host rate (16 of 1,563) on a far larger footprint, so the honest reading is that WebLogic was a low-yield line of effort by confirmed-compromise count, not that the exploit failed. Its six-week staging-server window is also a different dataset from CloudSEK's seven months of honeypot telemetry, so the exploitation observed since January is not established to be this operator's.

Where the activity surfaces. Exploitation is HTTP traffic to a proxy tier, so the telemetry is the proxy's own request logs rather than anything on the WebLogic host. Look for malformed or structurally anomalous requests aimed at the plug-in's forwarding path, and for forwarded requests reaching backend WebLogic contexts that the proxy's own routing rules should never produce. Because the flaw grants unauthorized read and write access at the proxy rather than code execution on the origin, backend application logs may show requests that are individually well-formed and correctly authenticated from the backend's point of view: the discriminator is the mismatch between what the front-end received and what the back-end was asked to do, not a malformed request arriving at the application.

Triage: a benign lookalike is a misconfigured client or scanner producing malformed forwarding requests against the same path, which is common on an internet-facing proxy. What separates the two is what follows: a benign malformed request produces an error and stops, while exploitation is followed by backend access to data the requesting session was never entitled to. Correlate the proxy log with the backend access it produced rather than triaging the proxy log alone.

Builds on: Tomcat clustering flaw KEV-listed in August; SNOWLIGHT operators were exploiting it in April