CVE-2026-21962

Modified

Published: 20 Jan 2026, 21:56

Last modified:02 Feb 2026, 23:05

Vulnerability Summary

Overall Risk (default)

high

70/100

CVSS Score

10 CRITICAL

v3.1 (cve.org)

EPSS Score

43.23% HIGH

43% probability +43.21%

KEV

Listed

CISA

1 listing

Ransomware

No reports

Public exploits

None found

Dark Web

Not detected

Timeline

20 Jan 2026, 21:56

Published

Vulnerability first disclosed

02 Feb 2026, 23:05

Last Modified

Vulnerability information updated

24 Aug 2026, 00:00

Added to CISA KEV

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

27 Aug 2026, 00:00

CISA Remediation Due

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

CVSS Metrics

v3.1•CRITICAL•Score: 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 43.23%• Percentile: 99%

Techniques & Countermeasures

CWE-284•Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected Systems

oracle corporation•oracle http server, oracle weblogic server proxy plug-in
12.2.1.4.0 | 14.1.1.0.0 | 14.1.2.0.0
oracle•http_server
12.2.1.4.0 | 14.1.1.0.0 | 14.1.2.0.0
oracle•weblogic_server_proxy_plug-in
12.2.1.4.0 | 14.1.1.0.0 | 14.1.2.0.0