Attackers are exploiting the plug-in in front of Oracle WebLogic

On 24 August 2026, CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The flaw sits in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. Oracle scores it 10.0 under CVSS 3.1, and a fix has been available since the company's quarterly security update of 20 January 2026. The catalogue entry sets 27 August 2026 as the remediation deadline for United States federal civilian agencies.

What happens technically

Oracle names the affected components as the WebLogic Server Proxy Plug-in for Apache HTTP Server and the WebLogic Server Proxy Plug-in for IIS. A proxy plug-in of this kind receives requests inside a web server and forwards them to the application server behind it. The component therefore sits at the edge, where traffic arrives, rather than inside the application itself. Affected versions are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. A footnote to Oracle's risk matrix adds that the IIS plug-in is affected only in version 12.2.1.4.0.

The weakness is classified as improper access control, CWE-284. Oracle calls it easily exploitable by an unauthenticated attacker with network access over HTTP. The vector Oracle publishes is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. One element of that vector deserves attention. Scope is marked as changed, and Oracle states plainly that attacks may significantly impact products other than the vulnerable one. The company also states that a successful attack can result in unauthorised reading, creation, modification and deletion of all data the component can reach. Availability, by contrast, is not affected. The score of 10.0 is therefore about data rather than about the service going down.

Oracle publishes no technical detail about the flaw itself. Its advisory says customers are not given the security analysis behind an update, and that the risk matrix is what they should base their own assessment on. On general mitigations, Oracle writes that blocking the protocols an attack depends on may reduce risk, while warning that this can break functionality and is no lasting solution. Neither Oracle nor CISA describes who is exploiting the flaw, or what the attacks look like. The CVE record also carries CISA's own SSVC assessment, which marks exploitation as active, automatability as yes and technical impact as total. That assessment is timestamped 21 January 2026, the day after the fix was published. The catalogue entry nevertheless arrived only on 24 August. None of the sources explains the gap between those two dates, and the timestamp may equally stem from a later edit to the record.

What this means for you if you run Oracle WebLogic

If you have Oracle HTTP Server or the proxy plug-in in front of WebLogic in one of the three affected versions, the January update is what the sources point to as the fix. Berigo's view is that the distance between January and August is not time you actually had. The catalogue does not say when the attacks began. It says when CISA judged the evidence strong enough to list the flaw. If you have deferred this update since January, installing it now is not the whole job. CISA's own directive requires United States federal civilian agencies to check whether anyone got in before the patch was applied, and that is a sensible step for you too.

Read the deadline of 27 August 2026 precisely. It follows from a United States directive, and it applies to federal civilian agencies there. It does not apply to you if you run a business in Norway, and it says nothing about how long you may wait. What it does tell you is how little time CISA believes this case can stand. Three days from listing to deadline is short. Berigo's view is that a component sitting at the internet edge deserves roughly that pace from you as well. If you do not know how many such plug-ins you have running, that inventory is the real task this week.

Berigo recommends

• Find every installation of Oracle HTTP Server or the WebLogic Server Proxy Plug-in running 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0, starting with anything exposed to the internet.
• Apply Oracle's January 2026 security update to every affected installation, and record when each one was patched.
• Look for traces of intrusion from the period before the update was applied, as CISA's directive requires of United States federal civilian agencies.
• Restrict who can reach the proxy layer from outside while you roll the update out, and do not treat network blocking as a lasting fix.
• Make the Known Exploited Vulnerabilities Catalog a standing input to your vulnerability management, so that a new entry forces a decision the same day.