CVE-2026-21962: Oracle HTTP Server and WebLogic Proxy Plug-in improper access control

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated network exploitation, scope change and confirmed CISA KEV listing with a near-term remediation deadline make this an urgent patch.

What it is

Oracle HTTP Server and the WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) contain an improper access control flaw (CWE-284) in supported versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0; the IIS plug-in is affected only at 12.2.1.4.0. It is remotely reachable over HTTP without authentication and carries a CVSS 3.1 base score of 10.0 with scope change, so it warrants immediate attention.

Impact

An unauthenticated attacker can create, delete or modify critical data and gain full read access to data reachable through the affected server and plug-in, with the impact extending to additional products due to scope change. Availability is not listed as impacted in the vector.

Attack surface

Reached over the network via HTTP (AV:N) with no privileges and no user interaction required (PR:N/UI:N), so any internet- or network-exposed Oracle HTTP Server or WebLogic Proxy Plug-in deployment is a candidate target.

Exploitation

CVE-2026-21962 is listed in CISA KEV with a 2026-08-27 remediation due date, and EPSS gives a 0.4202 probability (98.6th percentile), indicating observed exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Apply the Oracle January 2026 Critical Patch Update fixes for Oracle HTTP Server and the WebLogic Server Proxy Plug-in per the vendor advisory.
• If patching cannot be completed by the CISA due date, apply the mitigations in Oracle's guidance or discontinue use of the affected component, consistent with BOD 26-04.
• Restrict network access to the affected HTTP Server and proxy plug-in endpoints to trusted sources; do not leave them internet-exposed where avoidable.
• Confirm which deployments run the affected versions, noting the IIS plug-in is affected only at 12.2.1.4.0.
• Track remediation against the CISA KEV due date and escalate any remaining exposed instances.

Detection

• Review HTTP access logs on Oracle HTTP Server and proxy plug-in hosts for anomalous requests, unexpected URI patterns or access to resources outside normal application paths.
• Monitor for unauthorized creation, modification or deletion of files and configuration data on affected hosts and downstream systems.
• Alert on unexpected outbound or lateral connections originating from the affected servers, given the scope-change impact.
• Audit authentication and access-control decisions on the plug-in for requests that should have been denied but succeeded.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.