Oracle WebLogic Proxy Plug-in Flaw Hits CISA KEV

CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026, and gave federal civilian agencies until August 27 to remediate. That is a three day window for a CVSS 10.0 improper access control bug in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, a component that sits in front of the application tier rather than behind it. Oracle shipped the fix in its January 2026 Critical Patch Update. Seven months later attackers are still finding unpatched instances, which tells you most of what you need to know about WebLogic patch cadence in the field.

A 10.0 that lives at the edge

The score is earned. An unauthenticated attacker with network access over HTTP can compromise Oracle HTTP Server and the WebLogic Server Proxy Plug-in. No credentials, no user interaction, no local foothold required.

CISA describes the outcome as improper access control resulting in unauthorized creation, deletion, or modification of critical data, plus unauthorized access to critical data or complete access to all data reachable by Oracle HTTP Server and the Proxy Plug-in. Confidentiality and integrity are both fully in play, and the blast radius is defined by what the proxy tier can reach, not by what it stores.

That distinction matters. The Proxy Plug-in exists to forward requests from a web server to WebLogic managed servers. It is deliberately positioned where it can talk to the application tier. A component that brokers traffic into your app servers is a poor place for an unauthenticated access control failure.

Exploitation has been running since February

GreyNoise and CloudSEK both reported activity well ahead of the KEV listing.

• February 2026: a single IP address, 193.24.123[.]42, was observed probing for multiple known flaws at once, spanning Oracle WebLogic, Ivanti Endpoint Manager Mobile, GNU InetUtils, and GLPI. One host, four product families, all previously disclosed bugs.
• March 2026: CloudSEK reported CVE-2026-21962 exploitation attempts against its honeypot network.
• August 24, 2026: CISA added the CVE to KEV, citing evidence of active exploitation.
• August 27, 2026: remediation deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04.

The honeypot data is the more useful signal. Alongside CVE-2026-21962, CloudSEK captured attempts against CVE-2020-14882 and CVE-2020-14883 (console RCE), CVE-2020-2551 (IIOP RCE), and CVE-2017-10271 (WLS-WSAT RCE). Four of the five CVEs in that set are between five and nine years old. In CloudSEK's words, threat actors continue to rely on a small set of highly effective, simple to exploit vulnerabilities to compromise WebLogic environments.

You can act on that. If your WebLogic estate is exposed, the realistic attacker toolkit against it is short and stable. This is not a defense against novel research problem. It is a close a handful of well documented holes and keep them closed problem.

What the reporting does not tell you

Public detail on mechanics is thin. There is no published proof of concept in the source reporting, no named threat group, no post exploitation malware family, and no victim count. The only disclosed network indicator is the February scanning IP, and a six month old scanner address has limited detection value now. Scope your response to exposure, not to indicators.

Action list

• Inventory first. Find every Oracle HTTP Server instance and every WebLogic Proxy Plug-in deployment, including ones fronting applications your platform team did not install.
• Apply the January 2026 Critical Patch Update or later. Oracle CPUs are cumulative, so a current level covers CVE-2026-21962 and the older RCE set.
• Confirm the legacy bugs are closed too: CVE-2020-14882, CVE-2020-14883, CVE-2020-2551, and CVE-2017-10271. Honeypot traffic says they are still being tried.
• Remove the WebLogic admin console and the WLS-WSAT endpoint from internet reachability. Neither belongs on a public interface.
• If you cannot get a change window this week, restrict the affected virtual hosts at the load balancer or WAF to known consumer source ranges.

Detection and hunt

• Review Oracle HTTP Server access logs for anomalous paths against proxy routes, unusual HTTP methods, and requests that bypass expected application URI prefixes.
• Look for new or modified files under the OHS and plug-in configuration directories, and diff deployed application content against a known good baseline.
• Check WebLogic managed server logs for requests that arrived through the proxy but do not correlate to a legitimate front end session.
• Pull authentication and data access logs for services behind the proxy tier covering February 2026 to now. Exploitation started roughly seven months ago, so a lookback of days is not enough.

Bottom line

CVE-2026-21962 is not exotic. It is a maximum severity, unauthenticated, network reachable access control failure in a component built to sit at the perimeter, with a vendor patch available for seven months and confirmed exploitation for six. August 27 is a compliance date for FCEB agencies. For everyone else the deadline is whenever an opportunistic scanner reaches your address space, and on the available evidence that has probably already happened.