Secuno
ENNL
Book demo

CVE-2026-21962

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control

10.0 CRITICALActively exploited (CISA KEV)EPSS 73.2%
  1. Published20 Jan 2026
  2. Added to CISA KEV24 Aug 2026
  3. Remediation due27 Aug 2026
Actively exploited (CISA KEV)

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.

Added to KEV: 24 Aug 2026Federal remediation due: 27 Aug 2026

Description

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

Oracle HTTP Server12.2.1.4.0 · 14.1.1.0.0 · 14.1.2.0.0
Oracle Weblogic Server Proxy Plug-in12.2.1.4.0 · 14.1.1.0.0 · 14.1.2.0.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1075109.1
An authenticated high privilege user can inject arguments in troubleshooting commands…
CVE-2026-764989.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-764638.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-764559.8
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-976808.3
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to…
CVE-2026-1043358.8
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to…

Frequently asked

Is CVE-2026-21962 being actively exploited?

Yes. CVE-2026-21962 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 Aug 2026.

How severe is CVE-2026-21962?

CVE-2026-21962 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 73.2% probability of exploitation.

Which products are affected by CVE-2026-21962?

Affected products include Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in.

How do I fix CVE-2026-21962?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-21962 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.