CISA added CVE-2026-21962 — a CVSS 10.0, unauthenticated flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in — to the KEV catalog with an August 27 deadline. Only 12.2.1.4, 14.1.1 and 14.1.2 ever received the patch; Oracle says earlier versions are likely affected but untested. WebLogic 12.2's own support cliff lands December 2026.
The WebLogic Support Map
| Release line | Premier Support ends | Extended Support ends | CVE-2026-21962 patch? | Status |
|---|---|---|---|---|
| WebLogic 15c (15.1.1) | October 31, 2030 | October 31, 2033 | Current release line | Supported |
| WebLogic 14.1.x (14.1.1, 14.1.2) | December 31, 2030 | December 31, 2033 | Yes — patched in Jan 2026 CPU | Supported |
| WebLogic 12.2.x (12.2.1.4) | December 31, 2026 | December 31, 2027 | Yes — patched in Jan 2026 CPU | Premier ends Dec 2026 |
| WebLogic 12.1.x | December 31, 2017 | December 31, 2019 | No — never will be | EOL |
| WebLogic 11g (10.3.x) | December 31, 2018 | December 31, 2021 | No — never will be | EOL |
What's covered
- What Oracle's Advisory Actually Says
- The WebLogic Support Map
- Why the Proxy Plug-in Makes This Worse
- What To Do, By Situation
Full guide with every version, risk scores, and live updates: https://endoflife.ai/article-weblogic-cve-2026-21962
Top comments (0)