Oracle WebLogic CVE-2026-21962 (CVSS 10) Hits CISA KEV With a 3-Day Federal Patch Deadline

CISA has given federal agencies three days to patch a maximum-severity Oracle flaw, its tightest Known Exploited Vulnerabilities deadline on record, and the fix has been available since January. On August 24, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-21962 (CVSS 10.0), an improper access control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation. Federal Civilian Executive Branch agencies have until August 27 to remediate.

The number that matters for defenders is not the CVSS 10.0. It is the gap between two dates: Oracle shipped a patch in its January 2026 Critical Patch Update, and CISA had to compel installation seven months later because unauthenticated attackers were already reaching unpatched, internet-facing servers over plain HTTP. This is not a new zero-day. It is a known, fixed flaw that a lot of organizations never closed, now carrying a countdown clock.

What CISA Actually Added to the Catalog

CVE-2026-21962 lets an unauthenticated attacker with network access over HTTP compromise Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. No credentials, no user interaction, no existing foothold. In CISA’s own words, the components “contain an improper access control vulnerability that can result in unauthorized creation, deletion, or modification access to critical data as well as unauthorized access to critical data.” The Hacker News reported the KEV addition, and SecurityWeek confirmed the maximum severity rating and the active-exploitation basis for the listing.

Read that description precisely, because the impact class is broader than a data leak. “Creation, deletion, or modification” of critical data is a write primitive, not just a read one, and that is why the flaw scores a full 10.0 where a pure confidentiality bug would land lower. It is worth being careful, though, about what the primary sources do and do not say: CISA describes access to critical data, and the reporting frames the risk around data compromise and server takeover. Where coverage reaches for “remote code execution,” that is an inference about impact, not a claim in the KEV entry itself. Defenders should treat this as a critical, unauthenticated compromise of an internet-facing component and patch accordingly, without needing the RCE label to justify the urgency.

The Head Start Attackers Already Had

The exploitation timeline is the part that should change how you prioritize this. Oracle disclosed and patched CVE-2026-21962 in January 2026. Within weeks, the flaw was being probed. In February, The Hacker News noted a single IP address hammering a cluster of known enterprise vulnerabilities, WebLogic among them. By March, CloudSEK reported that its honeypot network was catching exploitation attempts aimed squarely at this bug. GreyNoise and CloudSEK have both tracked the activity since.

CloudSEK’s honeypot writeup put the behavior in context: “In addition to CVE-2026-21962, the honeypot captured attacks targeting other persistent, critical WebLogic RCE flaws,” the firm noted, adding that “threat actors continue to rely on a small set of highly-effective, simple-to-exploit vulnerabilities to compromise WebLogic environments.” In other words, WebLogic servers are a standing target, and a fresh 10.0 that works pre-authentication over HTTP slots neatly into an existing, automated hunt. The honeypots buzzed almost immediately after disclosure, which tells you scanning for this is cheap and already commoditized.

The diagram below tracks that seven-month runway, from the January fix to the three-day federal deadline. It is defender-oriented: milestones and dates, not exploitation mechanics.

The exposure clock for CVE-2026-21962, January fix to the August 27 federal deadline. Source: CISA, The Hacker News, CloudSEK, GreyNoise.

Why Three Days, and Why It Matters Past the Federal Deadline

The remediation obligation runs through Binding Operational Directive 26-04, and the window is genuinely unusual. The Register characterized the August 27 cutoff as the tightest three-day patching deadline CISA has attached to a flaw. Most KEV entries give agencies weeks. A 72-hour clock on a perfect-10, pre-authentication, internet-facing bug is CISA signaling that the exploitation it is seeing is not theoretical and not slow.

If you do not run a federal network, the deadline is still the most useful prioritization signal you will get this week. The KEV catalog is, formally, a compliance instrument for civilian agencies. Functionally, it is a vendor-neutral, exploitation-confirmed feed of the flaws most worth fixing first, and it is free. An organization that weights “is it in KEV?” heavily in its patch queue is borrowing CISA’s telemetry. On a WebLogic proxy flaw that already has months of scanning behind it, that telemetry says move it to the front. This is the same pattern we covered when CISA added a two-year-old WebLogic flaw, CVE-2024-21182, to KEV earlier this year: the news was never the CVE, it was the gap between an available fix and servers that never took it.

Where WebLogic Hides in Your Stack

The reason the exposure question is hard is that organizations routinely underestimate their WebLogic footprint. The server sits underneath a large slice of the Oracle stack: Oracle E-Business Suite, PeopleSoft, Siebel, and Fusion Middleware all ship or depend on it, and the HTTP Server and proxy plug-in are exactly the front-end pieces that get published to the internet. WebLogic also runs inside third-party and vendor-hosted products that a security team never installed directly and may not think to scan. An honest inventory has to reach past the instances you know you run to the ones bundled inside other software and managed by someone else. Every one of those, reachable over HTTP, is in scope for CVE-2026-21962, and the ones you have forgotten about are the ones most likely to still be on a pre-January patch level. This is why exposure discovery, not just patching, is the first move: you cannot patch a server you have not found, and the KEV clock does not pause for an incomplete asset inventory.

What Is Not Yet Confirmed

Careful scoping matters here, and several details circulating in secondary coverage are not nailed down by the primary sources. The exact affected and fixed version strings for Oracle HTTP Server and the WebLogic Proxy Plug-in are not specified in the KEV entry or the tier-one reporting I could verify; the load-bearing, confirmable fact is that Oracle’s fix shipped in the January 2026 Critical Patch Update, so the current, patched release level is the baseline to target. No specific victim organizations have been named. And no threat actor has been attributed to this exploitation. Some secondary write-ups reach further on all three points, but I am flagging them as unconfirmed rather than restating them as fact. If Oracle or CISA publishes tighter version data or attribution, this piece will be updated.

None of that uncertainty changes the defender math. Reachability is the risk. An internet-facing Oracle HTTP Server or WebLogic proxy that is not on the January 2026 patch level should be treated as exposed regardless of whether a named group or a specific victim has surfaced.

What Defenders Should Do Now

• Patch immediately. Apply Oracle’s fix for CVE-2026-21962 to every Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in instance. The remediation has existed since the January 2026 Critical Patch Update, so for most environments this is a deployment problem, not a waiting-for-a-fix problem.
• Find your internet exposure first. Enumerate every HTTP Server and WebLogic proxy reachable from untrusted networks, including instances bundled inside other Oracle products and vendor-hosted stacks you do not directly administer. Those are the ones on the countdown clock.
• Review HTTP request logs. Pull and inspect proxy and HTTP Server logs for anomalous unauthenticated requests against the affected components. Because exploitation has run since roughly January, widen the lookback window rather than checking only the last few days.
• Prioritize by the KEV deadline. If BOD 26-04 applies to you, the hard date is August 27. If it does not, use that same date as your internal target. A confirmed-exploited 10.0 with a 72-hour federal clock belongs at the top of the queue.

My read: The scary attribute here is not the CVSS 10.0, it is that this was a solved problem in January and CISA still had to force the issue in August with the shortest deadline it has ever set. The recurring 2026 failure mode is not a shortage of patches, it is the distance between patch-available and patch-deployed on internet-facing infrastructure, and that distance is exactly the window attackers operate in. Measure it for your own exposed systems, because a fix you have not applied protects nothing. (That is my assessment; the confirmed facts are the KEV listing, the CVSS score, the January fix, and the August 27 deadline.)

For the wider context on Oracle’s patch cadence and the volume defenders are asked to keep up with, see our coverage of Oracle’s July 2026 Critical Patch Update and its 1,400-plus fixes.

Primary Documents

• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-21962 entry)
• CISA Alert: CISA Adds One Known Exploited Vulnerability to Catalog (August 24, 2026)
• The Hacker News: Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
• The Register: CISA Slaps Its Tightest Three-Day Patching Deadline on Perfect-10 Oracle Flaw
• SecurityWeek: CISA Warns of Exploited Oracle WebLogic Vulnerability