Skip to content
Critical RCE Vulnerability in Oracle WebLogic Proxy Plug-In Exploited

Critical RCE Vulnerability in Oracle WebLogic Proxy Plug-In Exploited

First seen 29 Oct 2026, 20:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 22:16 UTC
  • •CVE-2026-21962 is a critical RCE vulnerability with a CVSS score of 10.0.
  • •Affected systems include Oracle HTTP Server and WebLogic Proxy Plug-in versions 12.2.1.4.0 and 14.1.x.
  • •Active exploitation has been confirmed, and immediate patching is recommended.

CVE-2026-21962 is a critical Remote Code Execution vulnerability affecting Oracle HTTP Server and WebLogic Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The flaw allows unauthenticated attackers to exploit the system over HTTP, with a CVSS score of 10.0. The vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) list on August 24, 2026, indicating. Multiple tools have been released for both exploitation and detection, including a Java GUI exploit tool and a detection toolkit. Security professionals are urged to apply Oracle's January 2026 Critical Patch Update immediately. Failure to patch could lead to unauthorized access and potential full system compromise.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-20
CVE-2026-21962 published
Oracle disclosed a critical RCE vulnerability affecting multiple versions of its software.
Sploitus
2026-08-24
CVE added to CISA KEV list
CISA included CVE-2026-21962 in its list of actively exploited vulnerabilities.
Sploitus
2026-10-29
Public exploit tools released
Multiple exploit and detection tools for CVE-2026-21962 were published, including a Java GUI exploit tool.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-21962 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

Which versions are affected?
Affected versions include Oracle HTTP Server and WebLogic Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0.
Is this vulnerability being actively exploited?
Yes, CVE-2026-21962 is confirmed to be actively exploited in the wild.
What immediate actions should be taken?
Administrators should apply Oracle's January 2026 Critical Patch Update as soon as possible.