CISA Adds Critical Oracle WebLogic Vulnerability to Its Catalog of Actively Exploited Flaws

On Monday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog. The move was prompted by evidence of active exploitation in real-world attacks.

What's Wrong

The flaw has been assigned the identifier CVE-2026-21962 and a CVSS score of 10.0 — the highest possible. It falls into the improper access control class and allows an unauthenticated attacker with network access over HTTP to compromise Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in component.

According to CISA's description, a successful attack opens the door to the unauthorized creation, deletion, or modification of critical data, as well as full access to all information available to the vulnerable components. In other words, the attacker gets not just read access, but write access too.

Patches Exist, Attacks Continue

Oracle released fixes back in January, but that hasn't stopped the exploitation. Both GreyNoise and CloudSEK have reported attempted attacks.

In February 2026, it emerged that a single IP address (193.24.123.42) was probing several known vulnerabilities at once — in Oracle WebLogic, Ivanti Endpoint Manager Mobile, GNU InetUtils, and GLPI. A month later, CloudSEK recorded attacks against its network of honeypot traps.

Notably, alongside CVE-2026-21962, the traps caught the exploitation of older but still-thriving WebLogic holes: CVE-2020-14882/14883 (RCE in the console), CVE-2020-2551 (RCE via IIOP), and CVE-2017-10271 (RCE in WLS-WSAT). The researchers' conclusion is disheartening but predictable: attackers keep relying on a small set of simple, effective vulnerabilities to take over WebLogic environments. Why invent something new when the old stuff is still wide open?

Deadlines for Government Agencies

Under the binding operational directive BOD 26-04, U.S. federal civilian agencies were advised to apply the required fixes by August 27, 2026. Everyone else running an internet-facing WebLogic deployment would do well to hurry no less.

Source: The Hacker News