Back Buttondown

Oracle WebLogic CVE-2026-21962 hits CISA KEV

Buttondown • August 26, 2026

CISA added Oracle WebLogic CVE-2026-21962 to KEV after active exploitation; unauthenticated HTTP access can expose or alter critical server data, so teams should apply Oracle fixes and restrict exposed proxy paths.

Read on dailycyber.net →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Oracle WebLogic Flaw Under Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-21962, a critical vulnerability affecting Oracle HTTP Server and WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog. This flaw, with a CVSS score of 10.0, allows unauthenticated attackers to gain unauthorized access to critical data. Affected versions include 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. CISA has urged organizations to patch the vulnerability within three days due to evidence of active exploitation. The vulnerability was first disclosed in January 2026, with proof-of-concept code available shortly after. Attackers can exploit this flaw via manipulated URIs, leading to complete compromise of vulnerable systems. Organizations are advised to treat any exposed Oracle systems as compromised until patched. The situation is urgent as attacks have already been observed targeting this vulnerability. 17 sources 79

Extracted Entities

Oracle WebLogic CVE-2026-21962 hits CISA KEV

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)