CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

EPSS trend

Probability

73.19%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+30.72 pp

From 42.48% on 19-09-2026

19-09-202619-10-2026

EPSS score

73.19%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 24-08-2026
Federal due date: 27-08-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. www.oracle.com/security-alerts/cpujan2026.html nvd.nist.gov/vuln/detail/CVE-2026-21962

Public exploits

0 found

No public exploits indexed.

References

5 links

www.oracle.com/security-alerts/cpujan2026.htmlVendor AdvisoryPatch
x.com/0xacb/status/2015473216844620280Not Applicable
github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1Broken LinkNot Applicable
web.archive.org/web/20260129165916/https://github.com/Ashwesker/Ashwesker-CVE-2026-21962/issues/1Issue Tracking
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962Government ResourceUS Government Resource

Related vulnerabilities

CVE-2018-16890alpinecurl+125.35%7y ago06-02-2019 20:00libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.CVE-2018-2760oracle corporationhttp server+12.01%8y ago19-04-2018 02:00Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module). Supported versions that are affected are 12.1.3 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).CVE-2018-2561oracle corporationhttp server+11.97%8y ago18-01-2018 02:00Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: Web Listener). Supported versions that are affected are 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HTTP Server. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).CVE-2018-20843alpineexpat+407.11%7y ago24-06-2019 16:06In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).CVE-2013-2566canonicalubuntu_linux+1584.42%13y ago14-03-2013 22:00The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.CVE-2013-1862apachehttp_server+1124.89%13y ago10-06-2013 17:00mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

All vulnerabilities inoracle http server, oracle weblogic server proxy plug-in http_server weblogic_server_proxy_plug-in

CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References