CVE-2026-21962

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 10/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.

CISA Known Exploited Vulnerability

Vendor / Product Oracle — HTTP Server and Oracle Weblogic Server Proxy Plug-in

Date Added 2026-08-24

Remediation Due 2026-08-27

https://www.oracle.com/security-alerts/cpujan2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21962

Weakness Classification (1)

CWE-284

Affected Software (6)

Vendor	Product	Version
oracle	http_server	12.2.1.4.0
oracle	http_server	14.1.1.0.0
oracle	http_server	14.1.2.0.0
oracle	weblogic_server_proxy_plug-in	12.2.1.4.0
oracle	weblogic_server_proxy_plug-in	14.1.1.0.0
oracle	weblogic_server_proxy_plug-in	14.1.2.0.0