CVE entry · CVE-2026-21962
CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
- Actively exploited: added to CISA’s KEV catalog on August 24, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: August 27, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
Other Oracle vulnerabilities
-
Oracle E-Business Suite Improper Privilege Management Vulnerability
-
CVE-2026-35273Used by ransomwareOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
-
Oracle WebLogic Server Unspecified Vulnerability
-
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
-
CVE-2025-61884Used by ransomwareOracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
-
CVE-2025-61882Used by ransomwareOracle E-Business Suite Unspecified Vulnerability