{"id":11981,"date":"2026-08-25T12:07:10","date_gmt":"2026-08-25T18:07:10","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/"},"modified":"2026-09-29T11:59:39","modified_gmt":"2026-09-29T17:59:39","slug":"security-update-critical-rce-in-oracle-weblogic-actively-exploited","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/","title":{"rendered":"Security update: Critical RCE in Oracle WebLogic actively exploited"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via HTTP.<\/p>\n\n<p class=\"wp-block-paragraph\">Organizations using the affected versions\u201412.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0\u2014should treat this situation as a priority: apply the patch published by Oracle in its January 2026 update, limit the external exposure of services while remediation is completed, and review logs to identify potential anomalous accesses or requests.<\/p>\n\n<h2 class=\"wp-block-heading\">Affected product(s):<\/h2>\n\n<p class=\"has-text-align-left wp-block-paragraph\">The affected components include:<br \/>\u2022 Versions of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (Apache):<br \/>o 12.2.1.4.0<br \/>o 14.1.1.0.0<br \/>o 14.1.2.0.0<br \/>\u2022 Oracle WebLogic Server Proxy Plug-in for IIS version 12.2.1.4.0<\/p>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">A critical unauthenticated vulnerability has been reported affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache and IIS. By sending specially crafted HTTP requests, a remote attacker can compromise the proxy component without authentication. It has been identified as CVE-2026-21962 with a CVSSv3 score of 10.<\/p>\n\n<p class=\"wp-block-paragraph\">A successful exploitation can result in unauthorized access to confidential data and the ability to create, modify, or delete data processed by the proxy and, potentially, by subsequent applications, which represents a significant risk for enterprise environments, especially implementations connected to the internet.<\/p>\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n<p class=\"wp-block-paragraph\">\u2022 Restrict the network exposure of proxy server and HTTP components by placing them behind firewalls, WAF, or VPN\/ZTNA solutions, and allow access only from trusted networks.<\/p>\n\n<p class=\"wp-block-paragraph\">\u2022 Review web and proxy logs to detect suspicious request patterns, unexpected endpoints, or abnormal data access activity.<\/p>\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n<p class=\"wp-block-paragraph\">Immediately apply the Oracle critical patch update from January 2026 to all affected installations of Oracle HTTP Server and WebLogic Proxy Plug-in, prioritizing internet-connected systems.<\/p>\n\n<p class=\"wp-block-paragraph\">At the following link you can find information on how to proceed with the update of your system:<\/p>\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/support.oracle.com\/support\/?documentId=KA1396\">https:\/\/support.oracle.com\/support\/?documentId=KA1396<\/a><\/p>\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.oracle.com\/security-alerts\/cpujan2026.html#AppendixFMW\">https:\/\/www.oracle.com\/security-alerts\/cpujan2026.html#AppendixFMW<\/a><\/p>\n\n<h2 class=\"wp-block-heading\">Additional information:<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>https:\/\/www.redlegg.com\/blog\/security-bulletin-oracle-proxy-components-vulnerable-to-unauthenticated-attack<\/li>\n\n\n\n<li>https:\/\/www.oracle.com\/security-alerts\/cpujan2026.html<\/li>\n<\/ul>\n","protected":false},"featured_media":11057,"template":"","class_list":["post-11981","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab\" \/>\n\t\t<meta property=\"og:description\" content=\"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t\t<meta property=\"og:image:height\" content=\"469\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-08-25T18:07:10+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-29T17:59:39+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab\" \/>\n\t\t<meta name=\"twitter:description\" content=\"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#listItem\",\"name\":\"Security update: Critical RCE in Oracle WebLogic actively exploited\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#listItem\",\"position\":2,\"name\":\"Security update: Critical RCE in Oracle WebLogic actively exploited\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/\",\"name\":\"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab\",\"description\":\"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2025\\\/10\\\/Oracle_Logo.svg.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#mainImage\",\"width\":1280,\"height\":469},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\\\/#mainImage\"},\"datePublished\":\"2026-08-25T12:07:10-06:00\",\"dateModified\":\"2026-09-29T11:59:39-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab","description":"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#listItem","name":"Security update: Critical RCE in Oracle WebLogic actively exploited"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#listItem","position":2,"name":"Security update: Critical RCE in Oracle WebLogic actively exploited","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/","name":"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab","description":"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png","@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#mainImage","width":1280,"height":469},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/#mainImage"},"datePublished":"2026-08-25T12:07:10-06:00","dateModified":"2026-09-29T11:59:39-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab","og:description":"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via","og:url":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png","og:image:width":1280,"og:image:height":469,"article:published_time":"2026-08-25T18:07:10+00:00","article:modified_time":"2026-09-29T17:59:39+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Security update: Critical RCE in Oracle WebLogic actively exploited - Beacon Lab","twitter:description":"CISA has once again added CVE-2026-21962 to its catalog of actively exploited vulnerabilities, confirming attacks against vulnerable instances of Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. The flaw, with critical severity (CVSS 10.0), allows a remote and unauthenticated attacker to leverage an improper access control to obtain unauthorized access to critical information via","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2025\/10\/Oracle_Logo.svg.png"},"aioseo_meta_data":{"post_id":"11981","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-09-29 17:58:31","updated":"2026-09-29 20:53:52","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tSecurity update: Critical RCE in Oracle WebLogic actively exploited\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Security update: Critical RCE in Oracle WebLogic actively exploited","link":"https:\/\/beaconlab.us\/en\/publication\/security-update-critical-rce-in-oracle-weblogic-actively-exploited\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/11981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/11981\/revisions"}],"predecessor-version":[{"id":11982,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/11981\/revisions\/11982"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/11057"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=11981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}