CISA has added CVE-2026-21962, a maximum-severity vulnerability (CVSS 10.0) affecting Oracle HTTP Server and Oracle WebLogic Server, to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated attackers with network access via HTTP to access critical data. Active exploitation has been confirmed in the wild. The vulnerability requires no authentication, making it especially dangerous for internet-facing deployments. Organizations using Oracle WebLogic or Oracle HTTP Server are urged to apply patches immediately per CISA's guidance.
CVE-2026-21962 is a maximum-severity (CVSS 10.0) improper access control vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. An unauthenticated attacker with network access via HTTP can exploit the flaw to gain unauthorized creation, deletion, or modification access to critical data, as well as complete unauthorized access to all data accessible by Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Active exploitation has been observed by GreyNoise and CloudSEK. A single IP address (193.24.123[.]42) was observed in February 2026 attempting to exploit this and other known vulnerabilities. CloudSEK honeypots also captured attacks targeting related WebLogic RCE vulnerabilities including CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271, indicating threat actors rely on a small set of highly-effective, easy-to-exploit WebLogic flaws. Patches were released by Oracle in January 2026.
Apply Oracle's patches released in January 2026 for CVE-2026-21962 immediately. Federal Civilian Executive Branch (FCEB) agencies are required to apply fixes by August 27, 2026, per Binding Operational Directive (BOD) 26-04. Monitor for exploitation attempts targeting CVE-2026-21962 as well as legacy WebLogic RCE vulnerabilities (CVE-2020-14882/14883, CVE-2020-2551, CVE-2017-10271). Block or monitor the known malicious IP 193.24.123[.]42. Ensure Oracle WebLogic and HTTP Server instances are not exposed unnecessarily to the internet.
193.24.123[.]42
