---
schema: 1
kind: vulnerability
title: "CVE-2026-21962: an unauthenticated request bypasses access control in the Oracle WebLogic Server Proxy Plug-in, CISA KEV-listed on 24 August with exploitation running since January"
headline: "The DMZ component enterprises trust as their gateway to WebLogic has been exploited since January; CISA listed it on 24 August"
summary: >
  CISA added CVE-2026-21962 (CVSS 3.1 base 10.0) to the Known Exploited Vulnerabilities catalog on
  2026-08-24. The flaw sits in the request-handling logic of the Oracle WebLogic Server Proxy
  Plug-in for Apache HTTP Server and Microsoft IIS, and in Oracle HTTP Server, which bundles it. A
  remote attacker with no credentials, no privileges and no user interaction gains unauthorized
  read and write access to data the proxy handles, plus a pivot path into backend WebLogic
  clusters. Oracle fixed it in the January 2026 Critical Patch Update; CloudSEK honeypots recorded
  exploitation from 22 January, and SOCRadar's July analysis of an exposed China-nexus staging
  server lists it among the CVEs weaponised in a campaign focused on government infrastructure.
discovered_at: "2026-08-30T13:12:06Z"
updated_at: null
event_date: "2026-08-24"
run_id: 2026-08-30T1312Z-audit
priority: high
immediate_action: null
tags: [vulnerabilities, actively-exploited, cisa-kev, pre-auth, auth-bypass, patch-available, poc-public]
regions: [global, europe]
sectors: [public-sector]
entities: ["product:oracle-http-server", "product:oracle-weblogic-server-proxy-plug-in", "actor:unc5174", "actor:unc6586", "malware:snowlight"]
techniques: [T1190]
affected_products: ["Oracle HTTP Server", "Oracle WebLogic Server Proxy Plug-in"]
cves:
  - id: CVE-2026-21962
    cvss: "10.0"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status:
      - exploited
      - cisa-kev
      - poc-public
      - patch-available
    affected: >
      Oracle HTTP Server / Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0; WebLogic Server
      Proxy Plug-in for Microsoft IIS 12.2.1.4.0
    fixed: "Oracle Critical Patch Update, January 2026"
sources:
  - url: "https://www.netspi.com/blog/executive-blog/critical-vulnerability/oracle-weblogic-server-proxy-plugin-cve-2026-21962-overview-takeaways/"
    publisher: "NetSPI"
    date: "2026-01-22"
    role: primary
  - url: "https://www.securityweek.com/cisa-warns-of-exploited-oracle-weblogic-vulnerability/"
    publisher: "SecurityWeek"
    date: "2026-08-25"
    role: corroborating
  - url: "https://socradar.io/blog/snowlight-government-chinese-campaign/"
    publisher: "SOCRadar"
    date: "2026-07-31"
    role: corroborating
closed_sources: []
evidence:
  - quote: "This vulnerability allows an unauthenticated remote attacker to bypass security controls and potentially gain unauthorized access to backend WebLogic systems. Because these proxy plugins often sit in DMZ environments, the exposure is significant."
    publisher: "NetSPI"
  - quote: "The vulnerability has been exploited since January"
    publisher: "SecurityWeek"
  - quote: "It’s unclear which attacks triggered CISA’s alert for CVE-2026-21962."
    publisher: "SecurityWeek"
verification: multi-source
sourcing_note: >
  Contradiction between the two cited sources on what the flaw yields: NetSPI, the technical
  primary, describes unauthorized read and write access to proxied data with potential pivoting
  into backend WebLogic clusters, and does not use the term remote code execution anywhere;
  SecurityWeek calls it "the remote code execution flaw". NetSPI's framing is followed here
  because it is the only source that examines the mechanism, and the divergence is recorded rather
  than resolved. NetSPI is also the source of the affected-version list and the DMZ exposure
  argument; SecurityWeek is the source for the KEV listing date, the January patch and the
  exploitation timeline, and states plainly that the specific attacks behind the listing are not
  public. The government-sector targeting is SOCRadar's characterisation of one operator's
  reconnaissance list over a six-week window, a separate dataset from CloudSEK's exploitation
  telemetry. SOCRadar's victimology table records one confirmed compromise via this CVE out of 91
  unique hosts, and gives its confirmation method as blind RCE via an out-of-band callback, which
  is a third position on the mechanism question: NetSPI describes access-control bypass without
  code execution, SecurityWeek calls it a remote code execution flaw, and SOCRadar reports having
  achieved out-of-band code execution against a live host. The entry follows NetSPI on the
  mechanism and records the other two rather than resolving between them. Oracle's own
  Critical Patch Update advisory is not among the sources read. Only SecurityWeek dates the fix to
  the January 2026 updates; NetSPI directs readers to the Critical Patch Update without naming a
  month, so the date rests on SecurityWeek alone.
confidence: high
references:
  - 2026-08-05/cve-2026-34486-tomcat-encryptinterceptor-fail-open-kev
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 1
watchlist_hit: false
actions:
  - "Inventory Oracle HTTP Server and WebLogic Server Proxy Plug-in instances against 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, starting with anything terminating traffic in a DMZ, and confirm the January 2026 CPU is applied. Check deployment manifests and container images as well as installed hosts: the plug-in ships bundled, so it is routinely missed by inventories keyed on WebLogic Server itself."
  - "Pull proxy access logs back to 22 January for every instance that was both unpatched and internet-reachable, and reconcile each forwarded request against the backend access it produced. The flaw yields read and write access at the proxy rather than execution on the origin, so backend logs alone will show correctly-formed, correctly-authenticated requests and will not surface it."
updates: []
migrated_from: null
---

CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on 2026-08-24, with a CVSS 3.1 base score of 10.0. The flaw is in the request-handling logic of the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS, and in Oracle HTTP Server, which bundles the same component. It is reachable over HTTP with no authentication, no privileges and no user interaction, and it yields unauthorized read and write access to the data the proxy handles plus a route into the backend WebLogic clusters the proxy fronts: "this vulnerability allows an unauthenticated remote attacker to bypass security controls and potentially gain unauthorized access to backend WebLogic systems. Because these proxy plugins often sit in DMZ environments, the exposure is significant" ([NetSPI, 2026-01-22](https://www.netspi.com/blog/executive-blog/critical-vulnerability/oracle-weblogic-server-proxy-plugin-cve-2026-21962-overview-takeaways/)).

That last point is the whole finding. The proxy plug-in is not an application server; it is the component an estate deploys specifically to be the trusted boundary in front of one, which means the flaw does not sit behind the perimeter, it *is* the perimeter. Confirmed affected: Oracle HTTP Server and its proxy plug-in at 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0, and the WebLogic Server Proxy Plug-in for Microsoft IIS at 12.2.1.4.0 (same source). Oracle shipped the fix in its January 2026 Critical Patch Update.

**Exploitation is not new, only the listing is.** CloudSEK's honeypots recorded exploitation attempts from 22 January 2026, immediately after a public proof-of-concept appeared, and CISA has not said what prompted the August listing: "the vulnerability has been exploited since January", and "it’s unclear which attacks triggered CISA’s alert for CVE-2026-21962" ([SecurityWeek, 2026-08-25](https://www.securityweek.com/cisa-warns-of-exploited-oracle-weblogic-vulnerability/)). For a defender that inverts the usual reading of a KEV addition: this is not a newly weaponised flaw to get ahead of, it is confirmation that anything still unpatched has been reachable by a public exploit for seven months.

There is a targeting signal, and it is worth stating precisely, because it is one vendor's characterisation of a different dataset rather than an authority's account of this exploitation. SOCRadar's July analysis of an exposed staging server belonging to a China-nexus operator tracked as UNC5174 and UNC6586, associated with the SNOWLIGHT malware family, lists CVE-2026-21962 among the vulnerabilities weaponised in a campaign whose reconnaissance list SOCRadar says resolved overwhelmingly to government domains across more than a hundred countries ([SOCRadar, 2026-07-31](https://socradar.io/blog/snowlight-government-chinese-campaign/)). SOCRadar's victimology table is more specific than that summary suggests, and it cuts both ways: against 119 raw list entries and 91 unique hosts for the WebLogic-class campaign, it records exactly **one** confirmed compromise, with the confirmation method given as "Blind RCE via DNS/HTTP out-of-band callback" (same report). So this operator did use the exploit and got in once that SOCRadar can prove, on a target list that is overwhelmingly governmental, but it converted only about one host in ninety, against 80 of 80 for the same operator's Confluence campaign in that table. The cPanel campaign sits at a comparable per-host rate (16 of 1,563) on a far larger footprint, so the honest reading is that WebLogic was a low-yield line of effort by confirmed-compromise count, not that the exploit failed. Its six-week staging-server window is also a different dataset from CloudSEK's seven months of honeypot telemetry, so the exploitation observed since January is not established to be this operator's.

**Where the activity surfaces.** Exploitation is HTTP traffic to a proxy tier, so the telemetry is the proxy's own request logs rather than anything on the WebLogic host. Look for malformed or structurally anomalous requests aimed at the plug-in's forwarding path, and for forwarded requests reaching backend WebLogic contexts that the proxy's own routing rules should never produce. Because the flaw grants unauthorized read and write access at the proxy rather than code execution on the origin, backend application logs may show requests that are individually well-formed and correctly authenticated from the backend's point of view: the discriminator is the mismatch between what the front-end received and what the back-end was asked to do, not a malformed request arriving at the application.

**Triage:** a benign lookalike is a misconfigured client or scanner producing malformed forwarding requests against the same path, which is common on an internet-facing proxy. What separates the two is what follows: a benign malformed request produces an error and stops, while exploitation is followed by backend access to data the requesting session was never entitled to. Correlate the proxy log with the backend access it produced rather than triaging the proxy log alone.

**Defender takeaway:** find the plug-in, not the server. The component ships bundled inside Oracle HTTP Server and installs as an IIS extension, so estates that inventory WebLogic Server by name routinely miss it, and a DMZ host running only the proxy tier is exactly the machine least likely to appear on a WebLogic patch list. Apply the January 2026 CPU, and where an unpatched instance has been internet-reachable, work the seven-month exposure window as an assessment rather than closing the ticket on the patch.