CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24, 2026, confirming active exploitation of a maximum-severity, CVSS 10.0 flaw in the Oracle WebLogic Server Proxy Plug-in and Oracle HTTP Server. The agency gave federal civilian agencies just three days — until August 27 — to remediate, the tightest deadline CISA is authorised to set under Binding Operational Directive 22-01. The flaw allows a completely unauthenticated attacker with network access via HTTP to bypass proxy access controls and reach backend WebLogic Server instances directly, with a path to unauthorised data access, modification, and remote code execution.
What the Vulnerability Does
CVE-2026-21962 is an improper access control flaw in the WebLogic Server Proxy Plug-in — the component that sits in front of Apache HTTP Server and Microsoft IIS deployments to route requests into backend WebLogic application servers, including installations bundled with Oracle HTTP Server. Attackers combine path traversal sequences with manipulated HTTP headers to bypass the proxy’s access restrictions, allowing requests that should be blocked at the perimeter to reach internal WebLogic endpoints as though they originated from a trusted source.
No credentials, authentication tokens, or prior foothold are required. Successful exploitation can expose or modify critical application data held on the backend server and, depending on deployment configuration, provide a path to full remote code execution. SANS Internet Storm Center first flagged unusual scanning activity matching this pattern on January 28, 2026 — malformed traversal sequences and injected headers aimed at WebLogic proxy paths — well before CISA’s formal KEV confirmation seven months later, indicating a long reconnaissance and probing window preceded the escalation to active exploitation.
Oracle patched the vulnerability in its January 2026 Critical Patch Update. The eight-month gap between patch availability and KEV listing underscores how widely WebLogic proxy deployments have gone unpatched despite the fix being available since the start of the year.
Why This Matters for Enterprise Sectors
WebLogic underpins a large share of enterprise Java middleware across finance, healthcare, and government back-office systems — core banking integrations, claims processing platforms, and portals that broker access between public-facing web tiers and sensitive internal application logic. Because the proxy plug-in is specifically the layer meant to enforce access boundaries between internet-facing infrastructure and protected backend systems, this flaw defeats a control that many organisations rely on as a primary segmentation boundary rather than a secondary one.
Public proof-of-concept exploit code and active internet-wide probing have been reported since the CISA listing, meaning organisations still running unpatched deployments should assume opportunistic scanning is already underway rather than treating this as a theoretical risk.
Recommended Actions
Patch immediately. Apply Oracle’s January 2026 Critical Patch Update to all Oracle HTTP Server and WebLogic Server Proxy Plug-in deployments — for both Apache and IIS-fronted configurations. Treat any instance still on pre-January patch levels as compromised until proven otherwise.
Inventory exposed proxy instances. Identify every internet-facing WebLogic proxy deployment, including those bundled inside broader Oracle Fusion Middleware or Oracle HTTP Server installs that may not appear in standard asset inventories under a “WebLogic” label.
Hunt for exploitation indicators. Review proxy and WebLogic access logs for malformed path traversal sequences, anomalous header values, and requests reaching internal endpoints that should only be accessible from trusted upstream sources. Given the January reconnaissance activity, log retention covering the full patch gap window is valuable for retrospective compromise assessment.
Restrict at the network layer where patching is delayed. Where immediate patching isn’t feasible, restrict proxy plug-in exposure to known trusted source ranges and apply WAF rules targeting path traversal and header injection patterns as an interim compensating control — not a substitute for patching.
Federal civilian agencies face the August 27, 2026 BOD 22-01 deadline. Commercial organisations in finance and healthcare with PCI DSS, HIPAA, or UK FCA obligations covering WebLogic-hosted systems should treat this as a critical finding requiring immediate escalation and executive visibility.