Actively Exploited Oracle Web Logic Flaw Lets Unauthenticated Attackers Access Critical Data
Summary: CISA added CVE-2026-21962, a maximum-severity (CVSS 10.0) improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation. Oracle released patches earlier in January, but GreyNoise, CloudSEK, and SOCRadar have since reported exploitation attempts, including a China-linked actor using the flaw to deliver the SNOWLIGHT downloader across more than 100 countries.
Bottom line: An unauthenticated attacker with only HTTP network access can create, delete, or modify critical data, and FCEB agencies have until August 27, 2026 to patch under BOD 26-04 - a deadline that implies the exposure window stays open for months.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-10271CVE-2020-14882CVE-2020-2551CVE-2026-21962
- Related
- CVE-2026-21962: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Known Exploited Vulnerabilities · Aug 24, 2026CVE-2020-2551: Oracle Fusion Middleware Unspecified Vulnerability Known Exploited Vulnerabilities · Nov 16, 2023CVE-2017-10271: Oracle Corporation Web Logic Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022