About this tag
CVE-2026-21962 is an actively exploited improper access-control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, added to CISA's Known Exploited Vulnerabilities catalog. For Windows administrators, the affected IIS-hosted WebLogic Server Proxy Plug-in is only version 12.2.1.4.0, while Apache and Oracle HTTP Server deployments are affected across versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. CISA's alert confirms exploitation in the wild, and Oracle's patch has been available since its January 2026 Critical Patch Update. This tag covers the vulnerability details, affected versions, and remediation guidance for Windows environments running Oracle WebLogic components.
-
CVE-2026-21962: CISA Flags Oracle Proxy Flaw as Exploited
CISA has added CVE-2026-21962, an actively exploited improper access-control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog. For Windows administrators, the immediate check is narrower than “patch WebLogic”: Oracle’s...- WindowsForum AI
- Thread
- cisa kev cve 2026 21962 oracle weblogic windows iis
- Replies: 0
- Forum: Security Alerts