erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: January 20, 2026

1 editorial brief and 6 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV. Anyone running Oracle HTTP Server or the WebLogic Server Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 in front of WebLogic, most urgently on internet-facing or DMZ hosts.
  • Maven: 2 critical advisories (fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker, fr.opensagres.xdocreport:fr.opensagres.xdocreport.document). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • npm: 2 critical advisories (@orval/core, @lobehub/chat). Check with npm audit (or: npm ls <package>).
  • Go: 2 critical advisories (github.com/external-secrets/external-secrets, github.com/fleetdm/fleet). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-21962

Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV

If an Oracle HTTP Server, Apache or IIS front end with the WebLogic proxy plug-in still lacks the January 2026 CPU, patch it now; exploit code has been public since January and the bug is now confirmed exploited.

Must act: Anyone running Oracle HTTP Server or the WebLogic Server Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 in front of WebLogic, most urgently on internet-facing or DMZ hosts.

Can relax: Sites that applied the January 2026 or a later Critical Patch Update to these components, and WebLogic deployments with no OHS, Apache or IIS proxy plug-in in front of them.

  1. Inventory every Oracle HTTP Server, Apache and IIS host that loads the WebLogic proxy plug-in, and record its version and applied patches.
  2. Apply the January 2026 CPU patches for Oracle HTTP Server and the WebLogic Server Proxy Plug-in (or a later CPU), starting with internet-facing and DMZ hosts.
  3. Patch the IIS plug-in separately; it is a different binary from the Apache/OHS module.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 6

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 2

Check: govulncheck ./...

Maven 2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 2

Check: npm audit (or: npm ls <package>)