A maximum-severity flaw in Oracle HTTP Server and Oracle WebLogic Server is under active attack, and CISA has now added it to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-21962 with a CVSS score of 10.0, the vulnerability lets an unauthenticated attacker with basic network access compromise these servers via HTTP — no credentials required. Once in, attackers can read, create, modify, or delete sensitive data across the entire server environment.
Oracle released patches in January 2026, but exploitation has continued at scale. Security firms GreyNoise, CloudSEK, and SOCRadar have all observed active attacks in the wild. CloudSEK’s honeypot network caught exploitation attempts as far back as March. A China-linked threat actor has also tied this flaw into a broader campaign hitting government and commercial infrastructure in more than 100 countries, using it to deploy the SNOWLIGHT downloader alongside other long-standing WebLogic exploits like CVE-2020-14882 and CVE-2017-10271.
How to check if you’re affected
Affected products are Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. If your organization runs either and has not yet applied Oracle’s January 2026 Critical Patch Update, CVE-2026-21962 leaves you exposed to unauthenticated remote access. Confirm your patch level through Oracle’s support portal; versions before the January 2026 patch remain vulnerable. U.S. federal civilian agencies face a mandatory remediation deadline of August 27, 2026 under CISA’s Binding Operational Directive 26-04.
Sources
- The Hacker News — Oracle WebLogic flaw added to CISA KEV catalog
- CISA Known Exploited Vulnerabilities catalog (CVE-2026-21962)