Active Exploitation of Oracle HTTP Server / WebLogic Proxy Plug-in CVE-2026-21962

1. Basic Information

• Article Title: CISA Adds One Known Exploited Vulnerability to Catalog
• Publisher: CISA
• Publication Date: 2026-08-24
• Original Source: CISA
• Related Sources: Oracle January 2026 Critical Patch Update, CISA KEV Catalog, NVD
• Related Malware, Threat Groups, CVEs, and Products: CVE-2026-21962, Oracle HTTP Server, WebLogic Server Proxy Plug-in for Apache HTTP Server / IIS
• Severity: Emergency
• CISA KEV Remediation Deadline: 2026-08-27 (Deadline for U.S. federal civilian agencies. This does not imply a legal deadline for general enterprises.)

2. Executive Summary

This is an unauthenticated HTTP vulnerability in the Oracle HTTP Server and WebLogic Server Proxy Plug-in, which CISA has confirmed is actively exploited. A successful attack allows unauthorized reading, creation, modification, and deletion of sensitive data that the plug-in can access. Oracle already provided security fixes in the January 2026 Critical Patch Update.

3. Attack Flow

1. An attacker reaches the target Oracle HTTP Server or the WebLogic Server Proxy Plug-in on Apache/IIS via HTTP.
2. The attacker exploits the improper access control of CVE-2026-21962 without authentication.
3. If the attack is successful, the attacker can unauthorizedly read, create, modify, and delete sensitive data accessible to the plug-in.
4. Although CISA confirms active exploitation, public information does not disclose the actually used URIs, headers, payloads, or post-compromise activities.

Official impact descriptions from Oracle and NVD refer to impacts on confidentiality and integrity. OS command execution and RCE are not explicitly stated. This report does not assume RCE.

4. Attacker Position and Execution Location

The attacker is an unauthenticated user with network access to the target HTTP service. Targets include not only the backend WebLogic Server but also the preceding Oracle HTTP Server, Apache HTTP Server, or the WebLogic Server Proxy Plug-in on IIS.

5. Visibility for Victims and Administrators

• Victim: User interaction is not required, and there may be no clear signs on the user interface.
• Administrator: Requests arrive as external HTTP requests. Because there are no publicly available stable attack signatures, web access logs alone cannot confirm whether an attack succeeded.

6. Conditions for Success and Failure

Success Conditions

• Using a vulnerable version of Oracle HTTP Server or WebLogic Server Proxy Plug-in.
• The attacker can reach the HTTP/HTTPS service.
• Oracle's security fix for CVE-2026-21962 is not applied.

Publicly listed vulnerable versions include 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The Proxy Plug-in for IIS is only affected in version 12.2.1.4.0.

Failure Conditions / Risk Mitigation

• Oracle's security fix for CVE-2026-21962 has been applied.
• The affected Proxy Plug-in is not in use.
• Network access to the required HTTP/HTTPS services is restricted.

Oracle suggests blocking network protocols required for the attack as a temporary mitigation until patches are applied. However, this is not a permanent fix.

7. What Happens on Success

According to Oracle, unauthorized reading, creation, deletion, and modification of sensitive data or all data accessible to the target product are possible. The CVSS 3.1 score is 10.0, with High impacts on Confidentiality and Integrity, and None on Availability. The Scope is Changed, indicating potential severe impacts on additional products.

8. Observable Logs

• Email: Generally not relevant for direct observation of this vulnerability.
• Proxy/SWG/DNS: HTTP requests to the target OHS/Apache/IIS. Public information does not define exploit-specific URIs or patterns, so do not treat them as known IOCs.
• Endpoint/EDR: Official information does not indicate RCE, so do not treat the creation of web server child processes as a required sign of this vulnerability. Investigate any anomalies separately as subsequent compromises.
• Identity/IdP: This vulnerability does not require authentication, making it difficult to capture exploitation using IdP logs alone.
• SaaS/Cloud: If auditing features exist in the target application or connected destinations, check for unexpected data reading, modification, or deletion.
• Network: Correlate external access to the target HTTP service, scanning trends, web access timestamps, and application-side data modification timestamps.

9. Determining Attack Success

• Attack Attempt Observed (Success Unconfirmed): Suspicious unauthenticated HTTP requests to the target service are observed, but data impact cannot be confirmed.
• Information Theft or Session Compromise Confirmed: Unauthenticated data reading, creation, modification, or deletion is confirmed through audit logs or data diffs.
• Subsequent Compromise Confirmed: Impacts on additional systems or accounts originating from the unauthorized operations mentioned above are confirmed.

CISA's KEV listing indicates that active exploitation has been confirmed somewhere in the world, not proof that exploitation succeeded in your own organization.

10. Investigation Playbook

• Trigger: Confirm the KEV listing of CVE-2026-21962 and the existence or external exposure of vulnerable OHS/Proxy Plug-in versions.
• Initial Check: Check the deployment, version, and external exposure status of OHS, Apache, IIS, and the Proxy Plug-in. Verify the application status of the security fixes provided in the January 2026 Critical Patch Update.
• Endpoints: Check web server settings, plug-in configurations, and related data diffs. If child processes or persistence mechanisms are found, treat them as subsequent compromises exceeding the official impact scope of this vulnerability.
• Authentication/Cloud: Check the target application for data operations or privilege changes that do not match authentication entities.
• Subsequent Operations: Check for unauthorized data modifications, outbound transmissions, account changes, and access to other systems.
• Containment: Prioritize applying the relevant security fixes provided by Oracle. Until completion, restrict the public exposure range or connection sources of the target HTTP service to the absolute minimum.
• Judgment Categories: Record HTTP requests only, data impact confirmed, and subsequent compromise confirmed separately.

11. Defense and Detection Ideas

• Single Event: Because there are no published stable exploitation patterns, do not create detection rules based solely on specific URIs as facts.
• Time-Series Correlation: Correlate external requests to the target web service with subsequent data modifications or deletions that do not match authentication.
• Hunting: Inventory the deployment and external exposure status of vulnerable OHS/WebLogic Server Proxy Plug-in versions across all assets.
• Log Deficiencies: Without Proxy Plug-in versions/deployments, web access logs, and application/database audit logs, both vulnerability assessment and success determination are difficult.
• Priority Countermeasures: Apply the relevant security fixes provided by Oracle, minimize the external exposure scope, and retain web and application audit logs.

12. Facts / Inference / Hypothesis

Facts

• CISA added CVE-2026-21962 to KEV on 2026-08-24 and confirmed active exploitation.
• The CISA KEV remediation deadline is 2026-08-27.
• Oracle published security fixes for CVE-2026-21962 in the January 2026 Critical Patch Update.
• The vulnerability is unauthenticated, HTTP-based, has low complexity, requires no user interaction, and has a CVSS 3.1 score of 10.0.
• Official impacts affect data confidentiality and integrity, with Availability set to None.

Inference

• Inventorying only backend WebLogic servers may cause organizations to overlook preceding OHS/Apache/IIS Proxy Plug-ins.
• Because stable exploitation IOCs are not publicly available, asset identification and patch verification should take priority over searching for detection signatures.

Hypothesis

• Public information lacks sufficient grounds to infer attackers, target industries, or attack scale, so no specific attack campaign profile is assumed.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): CISA has confirmed active exploitation, abusing vulnerabilities in the web proxy layer that can be publicly exposed via unauthenticated HTTP.

Data modification is published only as a "potential impact upon success" and has not been confirmed in actual exploitation cases, so Stored Data Manipulation is not assigned.

14. Unknowns and Additional Investigation

The HTTP requests used in active exploitation, attackers, victim organizations, number of compromised instances, actually read/written data, and subsequent techniques cannot be confirmed from public information. OS command execution and RCE are also not confirmed from official Oracle/NVD impact descriptions.

15. Impact on SOCs and General Enterprises

The CISA KEV deadline of 2026-08-27 targets U.S. federal civilian agencies and is not a legal deadline for global enterprises. However, because active exploitation is confirmed, the vulnerability is unauthenticated, network-based, and has a CVSS score of 10.0, the urgency remains high for all organizations. Inventories must include not only backend WebLogic servers but also preceding Proxy Plug-ins on OHS, Apache, and IIS.

16. Summary by Target Audience

• For SOCs: Do not rely solely on published attack IOCs. Confirm target assets and patch statuses, and correlate web requests with unauthenticated data operations.
• For Administrators: Identify vulnerable Proxy Plug-ins and prioritize applying Oracle's security fixes for CVE-2026-21962. Restrict external access to the absolute minimum until patches are applied.
• For Users: This is a server-side vulnerability that requires no user interaction. Remediation by administrators is required.