CVE-2026-21962

Summary

CVE	CVE-2026-21962
State	PUBLISHED
Assigner	oracle
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-01-20 22:15:59 UTC
Updated	2026-08-25 04:18:11 UTC
Description	Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

Risk And Classification

Primary CVSS: v3.1 10 CRITICAL from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS: 0.420200000 probability, percentile 0.986080000 (date 2026-09-10)

CISA KEV: Listed on 2026-08-24; due 2026-08-27; ransomware use Unknown

Problem Types: CWE-284 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. | CWE-284 CWE-284 Improper Access Control

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	10	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`
3.1	CNA	DECLARED	10	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CISA Known Exploited Vulnerability

Vendor	Oracle
Product	HTTP Server and Oracle Weblogic Server Proxy Plug-in
Name	Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Required Action	Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes	https://www.oracle.com/security-alerts/cpujan2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21962

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Oracle	Http Server	12.2.1.4.0	All	All	All
Application	Oracle	Http Server	14.1.1.0.0	All	All	All
Application	Oracle	Http Server	14.1.2.0.0	All	All	All
Application	Oracle	Weblogic Server Proxy Plug-in	12.2.1.4.0	All	All	All
Application	Oracle	Weblogic Server Proxy Plug-in	14.1.1.0.0	All	All	All
Application	Oracle	Weblogic Server Proxy Plug-in	14.1.2.0.0	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Oracle Corporation	Oracle HTTP Server Oracle Weblogic Server Proxy Plug-in	affected 12.2.1.4.0 semver	Not specified
CNA	Oracle Corporation	Oracle HTTP Server Oracle Weblogic Server Proxy Plug-in	affected 14.1.1.0.0 semver	Not specified
CNA	Oracle Corporation	Oracle HTTP Server Oracle Weblogic Server Proxy Plug-in	affected 14.1.2.0.0 semver	Not specified

References

Reference	Source	Link	Tags
x.com/0xacb/status/2015473216844620280	134c704f-9b21-4f2e-91b3-4a467353bcc0	x.com	Not Applicable
www.oracle.com/security-alerts/cpujan2026.html	[email protected]	www.oracle.com	Patch, Vendor Advisory
web.archive.org/web/20260129165916/https://github.com/Ashwesker/Ashwesker-CVE...	134c704f-9b21-4f2e-91b3-4a467353bcc0	web.archive.org	Issue Tracking
www.cisa.gov/known-exploited-vulnerabilities-catalog	134c704f-9b21-4f2e-91b3-4a467353bcc0	www.cisa.gov	US Government Resource
github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1	134c704f-9b21-4f2e-91b3-4a467353bcc0	github.com	Broken Link, Not Applicable
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis
CISA Known Exploited Vulnerabilities catalog	CISA	www.cisa.gov	kev

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
ADP	2026-08-24T00:00:00.000Z	CVE-2026-21962 added to CISA KEV

There are currently no legacy QID mappings associated with this CVE.