Oracle WebLogic CVE-2026-21962 is a maximum-severity flaw (CVSS 10.0, CWE-284) that CISA added to its Known Exploited Vulnerabilities catalog on August 24, 2026, citing active exploitation. It lets an unauthenticated attacker with network access over HTTP compromise Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, enabling unauthorized creation, deletion, or modification of critical data and full read access to everything the plug-in can reach. Oracle shipped patches back in January 2026, so this is a case of a fix existing while unpatched instances stay exposed. Federal civilian agencies have a remediation deadline of August 27, 2026 under BOD 26-04.

The improper access control weakness affects the WebLogic Server Proxy Plug-in for Apache HTTP Server and for IIS, in supported versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Exploitation is not theoretical: GreyNoise, CloudSEK, and SOCRadar have all reported activity. A single IP (193.24.123.42) was seen in February 2026 probing WebLogic alongside Ivanti EPMM, GNU InetUtils, and GLPI, and CVE-2026-21962 also appears in a China-linked campaign that hit government and commercial targets across more than 100 countries to deliver the SNOWLIGHT downloader.

Which Oracle WebLogic versions are affected and how do I fix it?

The vulnerable component is the WebLogic Server Proxy Plug-in bundled with Oracle Fusion Middleware, in the supported releases listed below. The fix is Oracle's January 2026 Critical Patch Update; if you cannot confirm that CPU is applied on every proxy front end, assume you are exposed and prioritize accordingly.

Why is a January patch still being exploited in August?

Because the exposure lives on internet-facing proxy front ends that are easy to forget in a patch cycle. CloudSEK's honeypots captured CVE-2026-21962 attacks arriving next to years-old WebLogic classics like CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271, and drew the blunt conclusion that attackers keep leaning on a small set of highly effective, simple-to-exploit WebLogic flaws. An eight-month-old patch does nothing for the instance nobody remembered was reachable, which is exactly the gap opportunistic scanners and state-linked actors both mine.

Our read

CVE-2026-21962 is a textbook argument for continuous verification over trust in the patch record. A 10.0 with a public patch since January and a China-linked campaign behind it is not a "did we patch" question, it is a "can we still be reached" question, and the two have different answers whenever inventory drifts from reality. Our analysis of 2025 found the median gap between disclosure and exploitation was 26 days, yet this flaw shows the tail runs far longer: exposure persists for months on the assets a point-in-time review overlooks. The defensible move is to verify from the outside which of your WebLogic proxy front ends actually answer over HTTP, confirm the January CPU is live on each, and treat any that cannot be confirmed as compromised until proven otherwise.

Reporting by The Hacker News; CVSS, affected-version, and exploitation detail per CISA KEV, NVD, and CloudSEK. Sources linked above.

Related: What EPSS and KEV reveal about patch priority and Nexus Void continuous verification.