Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Oracle Corporation — Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
10.0
42.0%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
- Published
- Jan 20, 2026
- Modified
- Aug 25, 2026
- Added to KEV
- Aug 24, 2026
- Federal patch due
- Aug 27, 2026
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
8 foundWeaponization
Public repositories whose name or description references CVE-2026-21962, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit — cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- boroeurnprach/Ashwesker-CVE-2026-21962★ 6
CVE-2026-21962
updated Sep 11, 2026
- samael0x4/CVE-2026-21962★ 6
Unauthenticated vulnerability that may allow remote attackers to compromise confidentiality and integrity, potentially leading to full system compromise.
updated Aug 31, 2026
- gregk4sec/cve-2026-21962★ 4
updated Aug 29, 2026
- zeetee1235/CVE-2026-21962★ 3
updated Aug 29, 2026
- gglessner/cve_2026_21962_scanner★ 3
updated Aug 25, 2026
- George0Papasotiriou/CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-★ 3
Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in has an easily exploitable, unauthenticated, network-reachable flaw allowing compromise over HTTP. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0.
updated Apr 18, 2026
- ThumpBo/CVE-2026-21962★ 2
CVE-2026-21962-EXP
updated Jun 22, 2026
- 0xredash/CVE-2026-21962★ 2
CVE-2026-21962
updated Sep 16, 2026
References
How this class of flaw gets exploited
Frequently asked questions
What is CVE-2026-21962?
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
How severe is CVE-2026-21962?
CVE-2026-21962 has a CVSS base score of 10.0 out of 10 (CVSS 3.1).
Is CVE-2026-21962 actively exploited in the wild?
Yes. CVE-2026-21962 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Aug 24, 2026, meaning CISA has confirmed evidence of active exploitation.
What is the EPSS score for CVE-2026-21962?
42.0% - meaning FIRST.org's EPSS model estimates a 42.0% probability this vulnerability will be exploited in the wild within 30 days (99% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2026-21962?
We found 8 public GitHub repositories referencing CVE-2026-21962, though none matched a known Nuclei template or Metasploit module at last check. Review each one before relying on it - see the proof-of-concept section above.
What type of vulnerability is CVE-2026-21962?
CVE-2026-21962 is classified under CWE-284 (CWE-284 Improper Access Control).
Cross-checked against
Impactr finds and proves whether CVE-2026-21962 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.