[URGENT] Oracle HTTP Server / WebLogic Proxy Plug-in CVE-2026-21962: Apply the January 2026 CPU Now — Unauthenticated Data Tampering

Bottom line first. If you run Oracle HTTP Server or Oracle WebLogic Server Proxy Plug-in at 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0, verify today that the January 2026 Oracle Critical Patch Update (CPU) has been applied. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on August 24, 2026, with a remediation deadline for US federal agencies of August 27, 2026. The patch has been available since January. This is not a new hole — it is an unpatched hole that attackers are actively using.

What is happening

CVE-2026-21962 is an improper access control flaw (CWE-284) in Oracle Fusion Middleware, specifically in Oracle HTTP Server and the WebLogic Server Proxy Plug-in. The affected components are the "Weblogic Server Proxy Plug-in for Apache HTTP Server" and the "Weblogic Server Proxy Plug-in for IIS" — the plug-in that sits in front of WebLogic and relays requests from Apache HTTP Server or IIS.
Per Oracle's own risk matrix, the flaw is remotely exploitable over HTTP without authentication (Remote Exploit without Auth: Yes). A successful attack allows unauthorized read, creation, deletion, and modification of critical data accessible to the product. It is also rated as a scope change (S:C), meaning impact can extend beyond the plug-in itself to connected products — which is what pushes this to a 10.0.

Who assigned that score

The 10.0 above is Oracle's own CVSS v3.1 assessment as the CNA (secalert_us@oracle.com), recorded in NVD as a Secondary metric. NVD has published no independent Primary score of its own, so it would be wrong to say "NIST rated this 10.0." The vector is `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`. Note that availability impact is None: this is not a denial-of-service issue but a data theft and tampering issue.
There is no CVSS v2.0 or v4.0 assessment for this CVE. If you see a different number elsewhere, check the version and the assessor first.

Affected versions

• ▸Oracle HTTP Server: 12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0
• ▸WebLogic Server Proxy Plug-in (for Apache HTTP Server): 12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0
• ▸WebLogic Server Proxy Plug-in (for IIS): 12.2.1.4.0 only (Oracle's Note 1)
• ▸Fixed by: the patches shipped in the Oracle Critical Patch Update of January 2026

What to do right now

• ✓Inventory your Oracle HTTP Server and WebLogic Server Proxy Plug-in installations and check whether any run 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0
• ✓Confirm the January 2026 CPU has been applied. If not, obtain the relevant patch through the Patch Availability Document on My Oracle Support and apply it
• ✓Remember the IIS plug-in is affected only at 12.2.1.4.0. Where Apache and IIS plug-ins coexist, assess each separately
• ✓Check the patch state of the front-end plug-in separately from the application server itself, particularly where the two are managed by different teams or change processes
• ✓Because exploitation is already confirmed, review historical HTTP access logs for suspicious requests through the proxy even after patching

If you cannot patch immediately

In the Workarounds section of this CPU, Oracle states plainly that workarounds do not fix the underlying problem. In substance: blocking the network protocols required by an attack may reduce the risk of a successful attack, but it may break application functionality, so changes must be tested on non-production systems first, and neither approach should be considered a long-term solution.
So the only real remediation is applying the patch. This article deliberately publishes no invented configuration snippets or WAF rules. Improvising a workaround Oracle has not published risks both failing to block the attack and breaking your application. If change windows are the constraint, determine which proxies are reachable from the internet and move those to the front of the queue.

Why a January flaw is urgent in August

The CVE was published to NVD on January 20, 2026, and the patch shipped the same month. CISA added it to KEV on August 24 because evidence of exploitation in the wild was confirmed. In CISA's SSVC assessment, exploitation is recorded as "active," automatable as "yes," and technical impact as "total."
The automatable decision point asks whether an attacker can reliably automate the creation of exploitation events for a vulnerability. "Yes" means they can reliably automate steps 1-4 of the kill chain — reconnaissance, weaponization, delivery and exploitation. Read that as: independently of whether your organisation is being singled out, exploitation attempts can be generated at scale and at speed.
Do not settle for "we surely applied the January CPU." Verify the actual version on the affected hosts. The components Oracle lists here are the proxy plug-ins, not WebLogic Server itself, so confirming the server's patch state alone does not answer whether you are affected.

Primary sources