Oracle Patched It in January. CISA Says Attackers Are Exploiting It Now.
CISA has added CVE-2026-21962 to its Known Exploited Vulnerabilities catalogue, confirming that attackers are exploiting a maximum-severity flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in. Oracle patched it in January. The urgent question is whether that patch reached the proxy tier that stands between the internet and protected applications.
The vulnerability allows an unauthenticated attacker with HTTP network access to compromise affected deployments. Oracle assigns it a CVSS 3.1 score of 10.0 and says a successful attack can expose critical data or all data accessible through the affected components, as well as allow unauthorised creation, deletion or modification of that data.
CISA added the flaw to the catalogue on 24 August 2026 and set a 27 August remediation deadline for US federal civilian agencies. That unusually short window is not a new patch deadline. It is a warning that a patch available for seven months is now tied to observed exploitation.
The vulnerable component is the proxy boundary
The affected software is Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS. These components sit in front of WebLogic applications and forward HTTP traffic to backend servers.
That distinction matters. The advisory should not be reduced to a generic claim that every WebLogic Server installation is vulnerable. Exposure depends on whether an organisation operates the affected HTTP server or proxy plug-in and whether an attacker can reach it over HTTP or HTTPS.
It also explains the strategic impact. A reverse proxy is supposed to enforce routing and access decisions before requests reach protected applications. When that boundary fails, the attacker may affect data and services beyond the component in which the vulnerability resides. Oracle explicitly marks the scope as changed.
Which Oracle versions are affected
Oracle lists the following supported versions as affected:
- Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache HTTP Server: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0.
- WebLogic Server Proxy Plug-in for Microsoft IIS: 12.2.1.4.0 only.
The fix was delivered through Oracle’s January 2026 Critical Patch Update. Oracle’s public advisory identifies affected release families, while the precise patch package and installation procedure depend on the deployed Fusion Middleware stack and are provided through Oracle support documentation.
Administrators should inventory the actual front-end components, not search only for hosts labelled “WebLogic”. The proxy plug-in may run inside an Apache or IIS tier managed by a different team from the application servers behind it. A WebLogic inventory that omits those web tiers can produce a false sense of remediation.
CISA confirms exploitation, but not the campaign
Inclusion in CISA’s catalogue establishes that exploitation has occurred in the wild. It does not, by itself, identify the attackers, victims, exploit chain or scale of the activity. CISA has not published campaign-specific indicators with the catalogue entry.
The public evidence therefore supports an urgent patching story, not unsupported claims about a particular threat group or mass compromise. Oracle’s risk matrix describes confidentiality and integrity impact as high, availability impact as none, and exploitation as possible remotely without authentication or user interaction.
That combination is serious even without a public incident narrative. An attacker does not need a valid account, and the vulnerable component processes traffic at a trusted point in the application path. Organisations should assume that normal application authentication records may not provide a complete picture of attempts against the proxy layer.
The patch gap is now the operational story
Oracle released the January Critical Patch Update on 20 January 2026. CISA added the vulnerability to its exploited list on 24 August. The seven-month interval illustrates a recurring enterprise risk: middleware patches may exist long before defenders receive public confirmation that attackers are using the flaw.
Proxy and web-tier components are particularly easy to lose between ownership boundaries. Network teams may own the load balancer, platform teams may own Oracle Fusion Middleware, application teams may own WebLogic and Windows teams may own IIS. If the patch process is organised by product name rather than by request path, the exposed component can remain outside every team’s initial scope.
What defenders should do now
- Identify the proxy tier. Locate Oracle HTTP Server and WebLogic Server Proxy Plug-ins running under Apache HTTP Server or IIS, including systems owned outside the WebLogic administration team.
- Apply Oracle’s January 2026 security update. Confirm the exact supported release and patch package through Oracle’s Fusion Middleware patch documentation. Validate the installed build after maintenance.
- Prioritise reachable instances. Treat internet-facing and partner-facing proxy services as the first remediation group. HTTPS is affected when Oracle lists HTTP as the protocol because the secure protocol variant is included.
- Reduce exposure while patching. Restrict network access to required sources where operationally possible. Oracle warns that protocol blocking can disrupt application functionality and is not a substitute for installing the patch.
- Review proxy and downstream logs. Investigate unusual HTTP paths, unexpected requests reaching protected applications, unexplained data changes and access that lacks the normal authentication sequence. Preserve both front-end and backend evidence.
- Expand incident scope if exploitation is suspected. Because Oracle marks the vulnerability as scope-changing, assess data and applications reachable through the proxy rather than limiting investigation to the web-tier host.
- Retire unsupported deployments. CISA’s required action calls for discontinuing use when vendor mitigations are unavailable. Unsupported Oracle middleware should not remain an exposed compensating-control problem indefinitely.
The front door was patched months ago
The new fact is not that Oracle has finally produced a fix. The fix was available in January. The new fact is that CISA now has evidence that attackers are exploiting the access-control failure.
That makes this an inventory and execution test. Organisations need to know which component actually receives an external request, which team patches it and whether the January update reached every Apache and IIS proxy instance. The difference between “WebLogic is patched” and “the WebLogic access path is patched” is now operationally significant.
Sources
- CISA Known Exploited Vulnerabilities catalogue entry for CVE-2026-21962, added 24 August 2026.
- Oracle Critical Patch Update Advisory, January 2026, initially published 20 January 2026 and revised 2 February 2026.
- NIST National Vulnerability Database record for CVE-2026-21962.
- BlackTree vulnerability-intelligence record for CVE-2026-21962.
