---
title: "Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV"
url: https://erroneo.us/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/
description: "Unauthenticated CVSS 10 flaw in the WebLogic Proxy Plug-in for OHS/Apache and IIS. Fixed in the Jan 2026 CPU, public PoC, in KEV since Aug 24. Patch."
type: security-brief
section: "Security Digest"
date_published: 2026-01-20
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-21962"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Oracle HTTP Server CVE-2026-21962: CVSS 10 Flaw in KEV

**Verdict: Act now.** If an Oracle HTTP Server, Apache or IIS front end with the WebLogic proxy plug-in still lacks the January 2026 CPU, patch it now; exploit code has been public since January and the bug is now confirmed exploited.

- **Who must act:** Anyone running Oracle HTTP Server or the WebLogic Server Proxy Plug-in 12.2.1.4.0, 14.1.1.0.0 or 14.1.2.0.0 in front of WebLogic, most urgently on internet-facing or DMZ hosts.
- **Who can relax:** Sites that applied the January 2026 or a later Critical Patch Update to these components, and WebLogic deployments with no OHS, Apache or IIS proxy plug-in in front of them.
- **Affected:** Oracle HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0; WebLogic Server Proxy Plug-in for Apache HTTP Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0; WebLogic Server Proxy Plug-in for IIS 12.2.1.4.0
- **Fixed:** Oracle Critical Patch Update, January 2026 (released Jan 20, 2026), or any later CPU, for Oracle HTTP Server and the WebLogic Server Proxy Plug-in
- **CVEs:** CVE-2026-21962
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Oracle HTTP Server, Apache and IIS host that loads the WebLogic proxy plug-in, and record its version and applied patches.
2. Apply the January 2026 CPU patches for Oracle HTTP Server and the WebLogic Server Proxy Plug-in (or a later CPU), starting with internet-facing and DMZ hosts.
3. Patch the IIS plug-in separately; it is a different binary from the Apache/OHS module.
4. Until patched, restrict who can reach the proxy and block request paths containing ..; or /bea_wls_internal/ at the edge.
5. Apply the rest of the January 2026 CPU to the WebLogic servers behind the proxy.

### How to check if you are affected

- Search proxy access logs for request paths containing /bea_wls_internal/, ..; or /_proxy//weblogic/ and /wl_proxy//weblogic/.
- Check logs for the source IPs CloudSEK's honeypot recorded: 67.213.118.179, 41.251.179.181 and 149.28.149.165.
- Look for outbound DNS lookups of *.dnslog.cn or HTTP to 149.129.37.105:30005, the blind-RCE callback infrastructure in SOCRadar's campaign report.
- Review the WebLogic back ends for unexpected data changes, new accounts or deployments since January 2026.

## What happened

On January 20, 2026, Oracle's [January Critical Patch Update](https://www.oracle.com/security-alerts/cpujan2026.html) fixed CVE-2026-21962 in the WebLogic Server Proxy Plug-in for Apache HTTP Server and the Proxy Plug-in for IIS. Oracle files it under "Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in". The plug-in is the module that lets an Oracle HTTP Server (OHS), Apache or IIS front end forward requests to WebLogic. Oracle scores it CVSS 3.1 10.0 (`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N`). An unauthenticated attacker with HTTP access can create, delete or modify critical data and read all data the component can reach. Because the scope changes, the impact can extend past the proxy to other products, which in practice means the WebLogic back ends. Oracle does not describe the bug as code execution, and CISA classes it as improper access control.

Exploit code arrived fast. The [Canadian Centre for Cyber Security](https://cyber.gc.ca/en/alerts-advisories/oracle-security-advisory-january-2026-quarterly-rollup-av26-042) noted that a proof of concept was public by January 21. [CloudSEK](https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot) says an exploit was posted on GitHub on January 22, and its unpatched WebLogic honeypot logged the first attempt that same day. The probes requested paths such as `/_proxy//weblogic/..;/bea_wls_internal/ProxyServlet`. CloudSEK describes the bug as a WebLogic console RCE, which does not match Oracle's description, so trust its indicators more than its framing.

### Why it is in KEV now

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962) on [August 24, 2026](https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog), seven months after the patch, with a federal deadline of August 27. CISA did not say what evidence triggered the listing. The public record points to a move from probing to real use. On July 31, [SOCRadar](https://socradar.io/blog/snowlight-government-chinese-campaign/) described a China-nexus campaign against government infrastructure. Its toolkit included a `CVE-2026-21962.py` script aimed at 91 unique hosts, with one confirmed compromise. On August 26, [Singapore's Cyber Security Agency](https://csa.gov.sg/alerts-and-advisories/alerts/al-2026-111) warned that the bug "is reportedly being actively exploited," and added indicators on September 2.

## Who is affected

Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache are affected at versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. The IIS plug-in is affected at 12.2.1.4.0 only. That list comes from the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-21962) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-21962). Oracle tests only supported releases, and it warns that older ones are likely affected as well. The bug is in the front-end plug-in. A WebLogic server reached directly, with no OHS, Apache or IIS plug-in in front of it, is not what this CVE describes, although the same CPU fixed other WebLogic bugs.

## Do you really need to act?

If you applied the January 2026 CPU or any later quarterly CPU to these components, no. Oracle's CPUs are usually cumulative. If you didn't, yes, now. The bug is unauthenticated and low-complexity, exploit code has been public for nine months, and it now shows up in a China-nexus campaign toolkit. These proxies often sit in a DMZ facing the internet. Internal-only proxies can wait for this week's maintenance window.

## What to do now

1. Find every host that loads the plug-in. On Linux, `grep -rlE "WebLogicHost|WebLogicCluster" <OHS or Apache config dir>` finds the proxy directives, and `$ORACLE_HOME/OPatch/opatch lspatches` lists the patches applied to an OHS home.
2. Apply the January 2026 CPU (or a later one) for Oracle HTTP Server and the proxy plug-in, starting with internet-facing hosts. Oracle lists Fusion Middleware patches in My Oracle Support Doc ID KA1182.
3. Patch IIS front ends separately. The IIS plug-in is its own binary.
4. If patching must wait, limit who can reach the proxy, and block request paths containing `..;` or `/bea_wls_internal/` at a WAF or load balancer.
5. Apply the rest of the January CPU to the WebLogic servers behind the proxy.

## How to tell if you were hit

Search proxy access logs for `/bea_wls_internal/`, `..;`, `/_proxy//weblogic/` and `/wl_proxy//weblogic/`. Look for CloudSEK's honeypot sources: `67.213.118.179`, `41.251.179.181` and `149.28.149.165`. SOCRadar's campaign confirmed hits with blind out-of-band callbacks, so check DNS logs for `*.dnslog.cn` and egress logs for `149.129.37.105:30005`. SOCRadar does not tie those two indicators to this CVE alone. If any of these turn up, review the WebLogic back ends for data changes, new accounts or deployments since January.

## Timeline

- Jan 20, 2026 — Oracle publishes the January 2026 CPU with the fix, and the CVE is published.
- Jan 21, 2026 — The Canadian Cyber Centre reports a public proof of concept.
- Jan 22, 2026 — CloudSEK's honeypot records the first exploit attempt.
- Jul 31, 2026 — SOCRadar reports a CVE-2026-21962 tool in a China-nexus campaign toolkit.
- Aug 24, 2026 — CISA adds the CVE to KEV.
- Aug 26, 2026 — Singapore's CSA issues an active-exploitation alert, updated with indicators on Sep 2.

## Sources

1. [Oracle — Critical Patch Update Advisory, January 2026](https://www.oracle.com/security-alerts/cpujan2026.html)
2. [CVE record — CVE-2026-21962](https://www.cve.org/CVERecord?id=CVE-2026-21962)
3. [NVD — CVE-2026-21962](https://nvd.nist.gov/vuln/detail/CVE-2026-21962)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-21962](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21962)
5. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Aug 24, 2026)](https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog)
6. [Cyber Security Agency of Singapore — AL-2026-111: Active exploitation of vulnerability in Oracle HTTP Server and WebLogic Server Proxy Plug-in](https://csa.gov.sg/alerts-and-advisories/alerts/al-2026-111)
7. [Canadian Centre for Cyber Security — Oracle security advisory, January 2026 quarterly rollup (AV26-042)](https://cyber.gc.ca/en/alerts-advisories/oracle-security-advisory-january-2026-quarterly-rollup-av26-042)
8. [CloudSEK — Honey for hackers: attacks targeting CVE-2026-21962 on an Oracle honeypot](https://www.cloudsek.com/blog/honey-for-hackers-a-study-of-attacks-targeting-the-recent-cve-2026-21962-and-other-critical-weblogic-vulnerabilities-on-a-high-interactive-oracle-honeypot)
9. [SOCRadar — Tracing SNOWLIGHT: a China-nexus campaign against government infrastructure](https://socradar.io/blog/snowlight-government-chinese-campaign/)

---
Source page: https://erroneo.us/security/briefs/oracle-http-server-weblogic-proxy-cve-2026-21962/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt