CVE-2026-21962

10.0 CRITICAL 73% exploit odds Drop everything exploited in the wild Fix listed Auth & access Server

What it is

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

At a glance

Exploitability: Can be exploited over the network without logging in. High risk of data exposure, data tampering.
In the wild: CISA lists this as exploited in real attacks. Treat as urgent.
Fix: A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

2026-01-05 18:07 UTC ReservedThe CVE id was reserved by its CNA
2026-01-20 22:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2026-08-24 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
2026-08-25 04:18 UTC Last updatedMost recent change to the record
2026-08-27 Remediation deadlineCISA's due date for federal agencies to fix it

Why it ranks here

Exploited in the wild: yes, CISA lists it. This puts it above everything that is not.
Exploit odds: 73.2% in the next 30 days (EPSS).
Severity: 10.0 CRITICAL (CVSS).
Fix: a patch or advisory is linked.
It meets the bar for Drop everything: critical, and exploited or very likely to be.

Details

Published: 2026-01-20 22:15 UTC
Last modified: 2026-08-25 04:18 UTC
Added to CISA KEV: 2026-08-24
Exploit probability: 73.2% · EPSS, next 30 days
Weakness: CWE-284 · Improper access control
Record status: Analyzed

Affected

Oracle Http Server 12.2.1.4.0
Oracle Http Server 14.1.1.0.0
Oracle Http Server 14.1.2.0.0
Oracle Weblogic Server Proxy plug-in 12.2.1.4.0
Oracle Weblogic Server Proxy plug-in 14.1.1.0.0
Oracle Weblogic Server Proxy plug-in 14.1.2.0.0

Attack profile CVSS 3.1 · 10.0

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: None

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-21962.md and follow it. Check whether this project is affected by CVE-2026-21962. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

· More options · Status badge

Download Square Reddit

Fix and advisories

https://www.oracle.com/security-alerts/cpujan2026.html

References

NVD record · CVE.org record