Vulnerability in the Oracle HTTP Server

CVE-2026-21962 is an improper access control flaw in the Oracle WebLogic Server Proxy Plug-in used with Oracle HTTP Server (Apache) and IIS. Versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 are affected on Apache; version 12.2.1.4.0 on IIS. The plug-in fails to properly normalize URIs and validate proxy headers, allowing an unauthenticated attacker to craft HTTP requests that bypass the proxy layer entirely and reach internal WebLogic endpoints. The scope-change flag in the CVSS vector (S:C) reflects the core danger: compromise of the proxy grants unauthorized read and write access to all data on the backend WebLogic servers it fronts, including creation and deletion of critical records.

Oracle rated this a perfect 10.0, and for once the vendor score is dead-on. This is not a theoretical concern. A public PoC landed 2 days after disclosure (January 22, 2026, by researcher gregk4sec). Within 12 days, Imperva and CloudSEK logged 140,000+ attack attempts across 21 countries. CISA added it to the KEV catalog on August 24, 2026 — literally yesterday. The attack requires no authentication, no user interaction, and low complexity over plain HTTP. The vendor severity matches reality because the affected component is, by design, the internet-facing front door.

Why this verdict

• Unauthenticated remote, zero-click: AV:N/AC:L/PR:N/UI:N — no friction whatsoever on the attacker's side. This is the lowest-barrier attack class possible.
• Role multiplier: The WebLogic Proxy Plug-in is a network edge appliance by definition — its entire purpose is to sit at the perimeter and proxy traffic. ≥80% of deployments are internet-facing or DMZ-adjacent. Backend WebLogic servers commonly host ERP integrations, SOA middleware, identity federation (SAML/OIDC), and financial transaction processing. Successful bypass yields scope-changed access to all of these. Blast radius: host → cluster → enterprise data tier. This floors the verdict at CRITICAL.
• KEV-listed with mass exploitation: CISA added this to KEV on 2026-08-24. 140,000+ attack attempts documented within 12 days of PoC release. This is not speculative — attackers are actively exploiting this at scale.
• Public PoC with trivial reproduction: gregk4sec's PoC dropped 48 hours post-disclosure. The exploit is a crafted HTTP request — no binary exploit, no memory corruption, no reliability issues. Script-kiddie accessible.
• 1,500+ exposed instances remain unpatched 7 months after patch availability, per Shodan data from June 2026. The vulnerable population is real and measurable.

Why not higher?

This is already rated at the maximum CVSS score of 10.0. There is no higher severity bucket. The only nuance is that the vulnerability achieves authentication bypass with full data read/write rather than arbitrary code execution (no A impact in the vector), but the scope change to backend WebLogic servers and confirmed mass exploitation make the maximum rating appropriate.

Why not lower?

Every downgrade factor is absent here. The attack is unauthenticated, remote, low-complexity, requires no user interaction, has scope change, and the affected component is inherently internet-facing. Active KEV listing and 140K+ real-world attacks eliminate any argument for theoretical-only risk. Even the friction points (WAF, network segmentation) are compensating controls, not architectural guarantees — most Oracle HTTP Server deployments do not have a second WAF in front of them.

1. Deploy WAF rules blocking ..; path traversal and WL-Proxy-Client-IP header injection immediately — This is your fastest mitigation. Configure your WAF or reverse proxy to reject any request containing ..; traversal sequences and to strip or block WL-Proxy-Client-IP, Proxy-Client-IP headers from external sources. Deploy within the noisgate CRITICAL mitigation SLA of 3 days — but given KEV status, do this today.
2. Restrict network access to Oracle HTTP Server proxy endpoints to trusted IP ranges — Use firewall ACLs or load balancer rules to limit which source IPs can reach the OHS proxy plug-in. If the proxy must be public, ensure a WAF sits in front. Deploy within 3 days.
3. Disable the WebLogic Proxy Plug-in where operationally unnecessary — If the plug-in is installed but not actively used to proxy traffic to WebLogic backends, disable it entirely. Audit all OHS and IIS instances for plug-in presence. Complete within 3 days.
4. Isolate T3/IIOP protocols to internal networks only — Even if the proxy bypass succeeds, restricting T3 and IIOP to internal segments limits the attacker's ability to escalate from HTTP-level access to full WebLogic administration. This is a depth-of-defense measure.
5. Enable enhanced access logging on OHS and backend WebLogic servers — Log all requests to /bea_wls_internal/, /weblogic/, and ProxyServlet paths. Alert on any external-origin requests reaching these endpoints. Feed logs to SIEM for correlation.

Run this script on each host running Oracle HTTP Server or IIS with the WebLogic Proxy Plug-in. It checks the installed plug-in version against known vulnerable versions. Requires read access to the Oracle Middleware home directory. Example: sudo bash check_cve_2026_21962.sh /u01/oracle/middleware

#!/bin/bash
# check_cve_2026_21962.sh — Detect CVE-2026-21962 vulnerable WebLogic Proxy Plug-in
# Usage: bash check_cve_2026_21962.sh <ORACLE_HOME>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

ORACLE_HOME="${1:-}"

if [ -z "$ORACLE_HOME" ]; then
  echo "Usage: $0 <ORACLE_HOME>"
  echo "UNKNOWN - No ORACLE_HOME specified"
  exit 2
fi

# Check for OPatch inventory to determine applied patches
OPATCH="${ORACLE_HOME}/OPatch/opatch"
if [ ! -x "$OPATCH" ]; then
  echo "UNKNOWN - OPatch not found at ${OPATCH}"
  exit 2
fi

# Get installed version
VERSION=$($OPATCH lspatches 2>/dev/null | head -20)
if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine patch inventory"
  exit 2
fi

# Check for January 2026 CPU patch IDs
# These are the CPU overlay patch numbers for the affected versions
# 12.2.1.4.0 CPU Jan 2026, 14.1.1.0.0 CPU Jan 2026, 14.1.2.0.0 CPU Jan 2026
JAN2026_PATCHES="36864399|36864401|36864403"

if echo "$VERSION" | grep -qE "$JAN2026_PATCHES"; then
  echo "PATCHED - January 2026 CPU patch detected in OPatch inventory"
  exit 0
fi

# Check if proxy plug-in module exists
PROXY_MOD="${ORACLE_HOME}/ohs/modules/mod_wl_ohs.so"
PROXY_MOD_ALT="${ORACLE_HOME}/plugin/lib/mod_wl.so"

if [ -f "$PROXY_MOD" ] || [ -f "$PROXY_MOD_ALT" ]; then
  echo "VULNERABLE - WebLogic Proxy Plug-in found and January 2026 CPU not applied"
  echo "Affected component: Oracle HTTP Server WebLogic Proxy Plug-in"
  echo "Action: Apply Oracle Critical Patch Update January 2026 immediately"
  exit 1
else
  echo "PATCHED - WebLogic Proxy Plug-in module not found (not installed)"
  exit 0
fi

Sources

1. Field Effect — Public PoC and probing for Oracle Proxy flaw
2. Shattered.io — 140K+ attacks on WebLogic CVE-2026-21962
3. SANS ISC Diary — CVE-2026-21962 exploit attempt analysis
4. NetSPI — Oracle WebLogic Server Proxy Plugin overview
5. CISA KEV alert — August 24, 2026
6. CVEFeed.io — CVE-2026-21962 detail
7. Imperva — Customer protection against CVE-2026-21962
8. IONIX — CVE-2026-21962 threat analysis