Oracle WebLogic Proxy Plug-in Flaw Hits CISA KEV: CVSS 10.0, Unauthenticated, Exploited Since February

On August 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962, a critical security flaw, to its Known Exploited Vulnerabilities catalog. The vulnerability affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, both of which are components that sit in front of the application tier.

The flaw allows an unauthenticated attacker with network access over HTTP to gain unauthorized access to critical data and create, delete, or modify it across everything the proxy tier can reach. This includes both confidentiality and integrity, with the blast radius defined by what the proxy tier can reach, not by what it stores.

The severity of the flaw is highlighted by its CVSS score of 10.0, making it a high-risk vulnerability. Any organization running internet-reachable Oracle HTTP Server or WebLogic Proxy Plug-in instances is at risk, including federal civilian agencies which have until August 27, 2026 to remediate the issue under Binding Operational Directive 26-04.

Despite being available for seven months, many organizations have yet to apply the necessary patches. The flaw was first reported in February 2026, and CISA has cited evidence of active exploitation since that time.

Oracle released the fix in its January 2026 Critical Patch Update, but the delay in remediation highlights a broader issue with patch deployment. The flaw was exploited alongside other known vulnerabilities such as CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, and CVE-2017-10271, all of which were previously disclosed and had patches available.

The exploitation attempts were captured by honeypot networks, indicating that the threat actors are relying on a small set of highly effective, simple to exploit vulnerabilities to compromise WebLogic environments.

To mitigate the risk, organizations are advised to inventory all instances of Oracle HTTP Server and WebLogic Proxy Plug-in, apply the January 2026 Critical Patch Update or later, and close the legacy WebLogic Remote Code Execution (RCE) bugs. It is also recommended to remove the WebLogic admin console and the WLS-WSAT endpoint from internet reachability.

If a change window is not immediately available, restricting affected virtual hosts at the load balancer or Web Application Firewall (WAF) to known consumer source ranges is suggested. Detection and hunting for the vulnerability involve reviewing access logs for anomalous paths, looking for new or modified files, and checking WebLogic managed server logs for requests that do not correlate to legitimate front-end sessions.

The window of opportunity for exploitation is assumed to have been open for months, indicating that the patch deployment gap is a significant concern.