Skip to content

Oracle WebLogic Proxy Plug-in improper access control in CISA KEV (CVE-2026-21962)

Summary

On August 24, 2026, CISA added Oracle HTTP Server / Oracle WebLogic Server Proxy Plug-in CVE-2026-21962 (CVSS 10.0 Critical, improper access control, CWE-284) to the Known Exploited Vulnerabilities catalog, with a 2026-08-27 BOD 26-04 federal remediation deadline. The flaw is in the Weblogic Server Proxy Plug-in shipped with Oracle Fusion Middleware — the plug-in that fronts WebLogic backends through Apache HTTP Server (versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0) and IIS (12.2.1.4.0 only) — and an unauthenticated attacker with HTTP network access can use it to create, delete, modify, or read data across the proxy plug-in surface, with CISA describing potential impact on additional products (scope change). The vulnerability was already fixed in Oracle's January 2026 Critical Patch Update, so this KEV entry confirms in-the-wild exploitation of a patch that was available ~7 months earlier; the practical signal is that unpatched proxy front-ends to WebLogic estates are actively being probed.

CISA records ransomware use as unknown and identifies no actor, victim, or infrastructure. Notably, the only public "exploit" material tied to the CVE is a GitHub repository (Ashwesker/Ashwesker-CVE-2026-21962, now removed/404) whose sole surviving issue is community calls that its contents were fake PoCs — treat any circulating exploit code for this CVE as unverified noise until a reputable vendor or law-enforcement disclosure appears.

Tags

The KEV entry

CISA's entry (added 2026-08-24, BOD 26-04 due 2026-08-27) points to Oracle's January 2026 CPU as the remediation reference and adds no exploitation detail:

  • CWE: CWE-284 (improper access control)
  • CVSS 3.1: 10.0 Critical, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — unauthenticated, low-complexity, network attack vector, scope change, no availability impact recorded
  • Required action: apply mitigations per vendor instructions, follow BOD 22-01 for cloud services, or discontinue use if mitigations are unavailable
  • Affected components (Oracle): Weblogic Server Proxy Plug-in for Apache HTTP Server — 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0; Weblogic Server Proxy Plug-in for IIS — 12.2.1.4.0 only
  • Ransomware use: unknown; no actors, infrastructure, payloads, or victims identified

Defender priorities

  1. Patch the proxy layer, not just WebLogic. Confirm every host running the WebLogic Server Proxy Plug-in (Apache or IIS variants) is on the January 2026 CPU or later. A WebLogic application that is fully patched but sits behind an unpatched proxy plug-in is still a known-exploited exposure — the KEV entry targets the plug-in, not the core server.
  2. Treat internet-exposed proxies as patch-now. The CVSS profile (unauthenticated, HTTP-reachable, CVSS 10.0, 3-day federal deadline) means any proxy plug-in reachable from untrusted networks should be treated as already attempted against. Preserve access logs from the January 2026 patch window forward for the forensic-triage requirement under BOD 26-04.
  3. Audit what the proxy actually exposes. Improper access control in a proxy plug-in means the blast radius is whatever the back-end serves. Enumerate which WebLogic contexts, services, and data sets are reachable through each plug-in instance, and close down any that do not need to be exposed.
  4. Do not trust the "public PoC" ecosystem. The associated GitHub repository was removed and its only surviving issue accuses the author of fake PoCs (see the LLM-slop false-CVE pattern and the ChocoPoC fake-PoC campaign). Any exploit script, "leaked" tool, or urgent-patch-notice that references CVE-2026-21962 should be treated as unverified and screened for malware before execution — fake-exploit repositories are a known phishing and malware-delivery vector.
  5. Avoid attribution shortcuts. A KEV listing with no CISA-named actor is not evidence of any specific threat group. Do not link this entry to the Oracle E-Business Suite or earlier WebLogic exploitation campaigns without independent confirmation.

Assessment limits

  • CISA provides no exploitation detail, actor, victim, or infrastructure for CVE-2026-21962; the "known exploited" determination rests on CISA's (currently unpublished) evidence.
  • The January 2026 CPU is the only vendor fix reference; Oracle has not published a separate security advisory, exploit-analysis writeup, or affected-component clarification beyond the CPU list entry.
  • The public GitHub "exploit" repository (Ashwesker/Ashwesker-CVE-2026-21962) returns 404 as of capture; a January 29, 2026 archive capture of its issue #1 contains only community complaints that the repository posted fake PoCs. No functional, independently verified exploit code is available, so the technical mechanics of the improper access control remain undocumented.
  • The CVSS 10.0 score with zero availability impact and "easily exploitable / unauthenticated" wording is consistent with an access-control bypass exposing back-end data operations, but the exact API or request path is not described by Oracle or CISA.

Sources