Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV

What to do

Inventory every Oracle HTTP Server, Apache and IIS host that loads the WebLogic proxy plug-in, and record its version and applied patches.
Apply the January 2026 CPU patches for Oracle HTTP Server and the WebLogic Server Proxy Plug-in (or a later CPU), starting with internet-facing and DMZ hosts.
Patch the IIS plug-in separately; it is a different binary from the Apache/OHS module.
Until patched, restrict who can reach the proxy and block request paths containing ..; or /bea_wls_internal/ at the edge.
Apply the rest of the January 2026 CPU to the WebLogic servers behind the proxy.

How to check if you are affected or compromised

Search proxy access logs for request paths containing /bea_wls_internal/, ..; or /_proxy//weblogic/ and /wl_proxy//weblogic/.
Check logs for the source IPs CloudSEK's honeypot recorded: 67.213.118.179, 41.251.179.181 and 149.28.149.165.
Look for outbound DNS lookups of *.dnslog.cn or HTTP to 149.129.37.105:30005, the blind-RCE callback infrastructure in SOCRadar's campaign report.
Review the WebLogic back ends for unexpected data changes, new accounts or deployments since January 2026.

What happened#

On January 20, 2026, Oracle's January Critical Patch Update fixed CVE-2026-21962 in the WebLogic Server Proxy Plug-in for Apache HTTP Server and the Proxy Plug-in for IIS. Oracle files it under "Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in". The plug-in is the module that lets an Oracle HTTP Server (OHS), Apache or IIS front end forward requests to WebLogic. Oracle scores it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). An unauthenticated attacker with HTTP access can create, delete or modify critical data and read all data the component can reach. Because the scope changes, the impact can extend past the proxy to other products, which in practice means the WebLogic back ends. Oracle does not describe the bug as code execution, and CISA classes it as improper access control.

Exploit code arrived fast. The Canadian Centre for Cyber Security noted that a proof of concept was public by January 21. CloudSEK says an exploit was posted on GitHub on January 22, and its unpatched WebLogic honeypot logged the first attempt that same day. The probes requested paths such as /_proxy//weblogic/..;/bea_wls_internal/ProxyServlet. CloudSEK describes the bug as a WebLogic console RCE, which does not match Oracle's description, so trust its indicators more than its framing.

Why it is in KEV now#

CISA added the CVE to the KEV catalog on August 24, 2026, seven months after the patch, with a federal deadline of August 27. CISA did not say what evidence triggered the listing. The public record points to a move from probing to real use. On July 31, SOCRadar described a China-nexus campaign against government infrastructure. Its toolkit included a CVE-2026-21962.py script aimed at 91 unique hosts, with one confirmed compromise. On August 26, Singapore's Cyber Security Agency warned that the bug "is reportedly being actively exploited," and added indicators on September 2.

Who is affected#

Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache are affected at versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. The IIS plug-in is affected at 12.2.1.4.0 only. That list comes from the CVE record and NVD. Oracle tests only supported releases, and it warns that older ones are likely affected as well. The bug is in the front-end plug-in. A WebLogic server reached directly, with no OHS, Apache or IIS plug-in in front of it, is not what this CVE describes, although the same CPU fixed other WebLogic bugs.

Do you really need to act?#

If you applied the January 2026 CPU or any later quarterly CPU to these components, no. Oracle's CPUs are usually cumulative. If you didn't, yes, now. The bug is unauthenticated and low-complexity, exploit code has been public for nine months, and it now shows up in a China-nexus campaign toolkit. These proxies often sit in a DMZ facing the internet. Internal-only proxies can wait for this week's maintenance window.

What to do now#

Find every host that loads the plug-in. On Linux, grep -rlE "WebLogicHost|WebLogicCluster" <OHS or Apache config dir> finds the proxy directives, and $ORACLE_HOME/OPatch/opatch lspatches lists the patches applied to an OHS home.
Apply the January 2026 CPU (or a later one) for Oracle HTTP Server and the proxy plug-in, starting with internet-facing hosts. Oracle lists Fusion Middleware patches in My Oracle Support Doc ID KA1182.
Patch IIS front ends separately. The IIS plug-in is its own binary.
If patching must wait, limit who can reach the proxy, and block request paths containing ..; or /bea_wls_internal/ at a WAF or load balancer.
Apply the rest of the January CPU to the WebLogic servers behind the proxy.

How to tell if you were hit#

Search proxy access logs for /bea_wls_internal/, ..;, /_proxy//weblogic/ and /wl_proxy//weblogic/. Look for CloudSEK's honeypot sources: 67.213.118.179, 41.251.179.181 and 149.28.149.165. SOCRadar's campaign confirmed hits with blind out-of-band callbacks, so check DNS logs for *.dnslog.cn and egress logs for 149.129.37.105:30005. SOCRadar does not tie those two indicators to this CVE alone. If any of these turn up, review the WebLogic back ends for data changes, new accounts or deployments since January.

Timeline#

Jan 20, 2026 — Oracle publishes the January 2026 CPU with the fix, and the CVE is published.
Jan 21, 2026 — The Canadian Cyber Centre reports a public proof of concept.
Jan 22, 2026 — CloudSEK's honeypot records the first exploit attempt.
Jul 31, 2026 — SOCRadar reports a CVE-2026-21962 tool in a China-nexus campaign toolkit.
Aug 24, 2026 — CISA adds the CVE to KEV.
Aug 26, 2026 — Singapore's CSA issues an active-exploitation alert, updated with indicators on Sep 2.

Vulnerability records

CVE-2026-21962 · KEV 2026-08-24 · Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.