~/f4n6 $ grep -r "CVE-2026-21962 — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability" ./investigations/ --include="*.md"

CVE-2026-21962 — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Jeff Davies 24 Aug 2026 5 min read

1. Executive summary

CVE-2026-21962 is a critical (CVSS 10.0) improper access control vulnerability in the Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, affecting versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The flaw permits an unauthenticated, network-based attacker to compromise the plug-in via HTTP, resulting in unauthorized creation, deletion, modification, or complete access to all accessible data, with scope change impacting additional products. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-24 with a remediation due date of 2026-08-27. EMEA financial services running Oracle Fusion Middleware with the affected proxy plug-in face immediate risk of data compromise and should treat patching as a P1 priority.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 18: classification of ICT-related incidents and cyber threats CVSS 10.0, KEV-listed, unauthenticated remote exploit with scope change — this is a high-severity cyber threat requiring formal classification under the entity's ICT incident taxonomy. Clients must classify this vulnerability as a cyber threat and assess whether exploitation constitutes a major ICT incident triggering Art. 19 reporting.
DORA Art. 24: digital operational resilience testing — general requirements KEV-listed vulnerability with a 3-day CISA remediation deadline in a critical middleware component. Clients must verify patch application and validate that the remediation does not break proxy routing, as part of operational resilience testing.
NIS2 Art. 23: incident reporting obligations Active exploitation (KEV) of a critical externally-facing component (HTTP proxy plug-in) may constitute a significant incident for in-scope financial entities. NIS2-in-scope organisations must assess whether exploitation has occurred and whether significant-incident notification timelines are triggered.

3. Technical analysis & attack chain

Affected components

  • Oracle Fusion Middleware — Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
  • Sub-components: Weblogic Server Proxy Plug-in for Apache HTTP Server; Weblogic Server Proxy Plug-in for IIS
  • Affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
  • Note: For Weblogic Server Proxy Plug-in for IIS, only version 12.2.1.4.0 is affected.

CVSS 3.1 Base Score: 10.0 (CRITICAL)

  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
  • Attack Vector: Network | Attack Complexity: Low | Privileges Required: None | User Interaction: None | Scope: Changed | Confidentiality: High | Integrity: High | Availability: None
  • CWE-284 (Improper Access Control), sourced from CISA-ADP.

Attack chain (confirmed from NVD/CISA data)

  1. Initial access: Unauthenticated attacker sends crafted HTTP requests to a server running the Oracle Weblogic Server Proxy Plug-in for Apache HTTP Server or IIS. No credentials, no user interaction, no special access required — network reachability to the proxy endpoint is sufficient.
  2. Vulnerability exploitation: The improper access control flaw (CWE-284) in the proxy plug-in allows the attacker to bypass intended authorisation boundaries. The CVSS scope-change flag (S:C) confirms the exploit escapes the vulnerable component's security context and impacts additional products behind the proxy.
  3. Impact: Successful exploitation yields unauthorized creation, deletion, or modification of critical data, and/or unauthorized read access to critical data or all data accessible through the plug-in. Confidentiality and Integrity are both rated High; Availability is not impacted (A:N).

CISA SSVC assessment (timestamp 2026-01-27): Exploitation = "none" at time of assessment, Automatable = "yes", Technical Impact = "total". The automatable flag indicates the vulnerability is trivially scriptable. The "none" exploitation state at SSVC assessment time predates the KEV addition on 2026-08-24, which confirms subsequent active exploitation.

Confidence caveat: The KEV listing confirms active exploitation. No threat actor attribution is available in the source material. No specific IOCs, payloads, or exploitation tooling are described. Technical mechanism detail beyond CWE-284 classification is single-sourced (NVD/CISA only); no vendor advisory or researcher write-up was available at time of writing.

4. Mitigation & containment

P1 — Within 24 hours (CISA KEV due date is 2026-08-27)

  1. Identify all affected instances. Search asset inventories for: - Oracle HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 - Weblogic Server Proxy Plug-in for Apache HTTP Server — versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 - Weblogic Server Proxy Plug-in for IIS — version 12.2.1.4.0 only
  2. Apply vendor patch immediately. Follow Oracle Critical Patch Update guidance. If no patch is available yet, apply vendor mitigations per Oracle instructions.
  3. Restrict network exposure. If the proxy plug-in endpoint is internet-facing, place it behind a WAF with virtual patching or restrict access to trusted source IPs only at the network layer. Block unauthenticated HTTP access to the proxy plug-in path.
  4. If mitigations are unavailable, discontinue use. CISA's required action explicitly states: "discontinue use of the product if mitigations are unavailable."

P2 — Within 72 hours

  1. Hunt for exploitation indicators. Review HTTP access logs for the proxy plug-in endpoint for anomalous unauthenticated requests — particularly requests that bypass expected authentication flows or produce unexpected data responses. Look for patterns consistent with access control bypass: requests to protected resources without valid session tokens returning 200 rather than 401/403.
  2. Validate scope-change impact. Because CVSS scope is Changed, assess what back-end systems the proxy plug-in fronts. Any Oracle Weblogic Server or downstream application reachable through the plug-in may have been accessed. Review application logs on those back-end systems for anomalous data access.
  3. Verify WAF/IDS coverage. Ensure network security tooling is configured to detect and block exploitation attempts targeting the proxy plug-in.

P3 — Within 7 days

  1. Confirm patch deployment across all environments including disaster recovery, staging, and any ephemeral instances that may re-provision with vulnerable images.
  2. Update asset inventory to reflect patched versions and flag any instances that cannot be patched for risk acceptance review.
  3. Review third-party hosting arrangements. If Oracle HTTP Server / Weblogic proxy plug-in is operated by a managed service provider, confirm the provider has patched and request evidence of remediation.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Unauthenticated HTTP requests to Weblogic Server Proxy Plug-in endpoints returning 200 OK for protected resources Web server access logs (Apache/IIS), WAF logs Medium — inferred from vulnerability mechanism, not from observed exploitation
Unexpected data creation, deletion, or modification in back-end systems fronted by the proxy plug-in Application logs, database audit logs on back-end Oracle Weblogic Server Medium — inferred from CVSS C:H/I:H impacts
Anomalous HTTP request patterns to proxy plug-in paths lacking authentication headers/tokens WAF, SIEM correlating HTTP logs with authentication events Medium — inferred from PR:N and CWE-284

6. Detection

Insufficient indicators to author detection rules. The source material provides no distinctive strings, file names, command-line artefacts, or network signatures associated with exploitation of this vulnerability. Detection should rely on the behavioural indicators in §5 — specifically, alerting on unauthenticated HTTP requests to Weblogic Server Proxy Plug-in endpoints that receive successful (200-series) responses for resources that should require authentication.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-21962 10.0 Critical ⚠ KEV 2026-08-24 43% Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: W…

7. Sources

  • NVD, "CVE-2026-21962 Detail," https://nvd.nist.gov/vuln/detail/CVE-2026-21962, published 2026-08-23
  • CISA, "Known Exploited Vulnerabilities Catalog — CVE-2026-21962," https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962, added 2026-08-24

8. Adverse Trace position

This is a maximum-severity (CVSS 10.0) vulnerability in a widely deployed Oracle middleware component, with confirmed active exploitation (CISA KEV, added 2026-08-24) and a 3-day remediation window. The unauthenticated, network-exploitable nature combined with scope change means a successful compromise extends beyond the proxy plug-in to back-end systems — a critical concern for financial services where the proxy typically fronts transactional applications and sensitive data stores. No threat actor attribution is available; treat as untargeted opportunistic exploitation until evidence suggests otherwise. Clients should complete P1 actions within 24 hours, prioritising internet-facing instances. Adverse Trace will monitor for vendor patch release, emerging IOCs, and any threat actor attribution, and will issue an update if the picture changes materially.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies