CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

What it is

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.

What to do

Treat this as urgent. Identify every affected system, starting with anything internet-facing, and apply the vendor fix or mitigation within days. If you cannot patch quickly, isolate or disable the affected service and watch for signs of compromise.

Priority

Act now: Patch or mitigate internet-facing systems within days.

Severity (CVSS)

10 critical

CISA assessment (SSVC)

actively exploited; attackers can automate it at scale; total control of the affected system

Exploit probability (EPSS, 30 days)

73%, in the top 1% of all CVEs

Added to CISA KEV

24 August 2026

CISA fix-by date

27 August 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-284

References

• NIST NVD entry
• CISA KEV entry
• www.oracle.com/security-alerts/cpujan2026.html
• github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1
• web.archive.org/web/20260129165916/https://github.com/Ashwesker/Ashwesker-CVE-20
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962
• x.com/0xacb/status/2015473216844620280

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.