Oracle HTTP Server / WebLogic Proxy Plug-in: Improper access control

Summary

Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (Apache HTTP Server and IIS variants) fail to properly check the identity and permissions of visitors when they parse or forward requests. An unauthenticated attacker with network access via HTTP can, according to Oracle, create, modify or delete data and access data accessible through the affected components, with a scope change to other products. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 24 August 2026, based on evidence of active exploitation.

Affected

• Apache HTTP Server plug-in and Oracle HTTP Server: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
• IIS plug-in: 12.2.1.4.0 only

Fixed in

• Fixed in Oracle Critical Patch Update of January 20, 2026
• Exact patch identifiers and minimum patched builds: Unknown. Check Oracle's advisory per component.

Workaround

• Oracle's patch is the remedy; the following measures only reduce exposure
• Restrict access to the WebLogic admin console and proxy endpoints via VPN, bastion host or firewall allowlists
• Temporarily disable the vulnerable plug-in where feasible
• Keep the proxy away from untrusted networks through network segmentation

Exploitation

• CISA lists the vulnerability as known exploited (KEV, added 24 August 2026)
• CloudSEK reported attacks against its honeypot network, including attempts against this CVE, in March 2026
• Secondary reports link exploitation to a China-linked actor; CISA has not confirmed attribution
• A public proof of concept was reported; its content has not been verified
• The federal due date is unclear in the sources (27 August 2026 is mentioned)

Our recommendation

• Check whether Oracle HTTP Server or WebLogic proxy plug-ins are installed, including those bundled with other products, and record their versions
• Apply the January 2026 Oracle CPU or a later cumulative CPU and verify the result
• Remove internet exposure of affected systems immediately if patching is delayed
• Review logs from the exposed period for suspicious requests and unexpected child processes, and check for persistence
• Monitor for further exploitation and check related WebLogic CVEs (CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, CVE-2017-10271)

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (10 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  samael0x4/CVE-2026-21962 · boroeurnprach/Ashwesker-CVE-2026-21962 · ThumpBo/CVE-2026-21962 · gregk4sec/CVE-2026-21962-o · George0Papasotiriou/CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-

Research sources

• Oracle Security Alert Advisory - January 2026 CPU www.oracle.com
• CISA adds one Known Exploited Vulnerability to catalog (24 August 2026) www.cisa.gov
• CISA KEV Catalog entry for CVE-2026-21962 www.cisa.gov
• SentinelOne vulnerability database: CVE-2026-21962 www.sentinelone.com
• NetSPI: Oracle WebLogic Server Proxy Plug-in CVE-2026-21962 overview www.netspi.com
• Sangfor FarSight Labs: CVE-2026-21962 analysis www.sangfor.com
• Security Affairs: CISA adds Oracle flaw to KEV catalog securityaffairs.com
• PT-2026-3709 (Positive Technologies database) dbugs.ptsecurity.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:53.