CISA Imposes 3-Day Patch Mandate on Perfect-10 Oracle WebLogic Proxy Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has imposed its tightest emergency patch mandate on a maximum-severity Oracle vulnerability that China-linked threat actors have exploited across government and commercial networks in more than 100 countries. CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle HTTP Server and the WebLogic Server Proxy Plug-in, allows unauthenticated remote attackers to bypass authentication and access critical backend data. Moreover, federal agencies must remediate by August 27, 2026, giving administrators just three days to patch.

What Happened: CISA Flags Oracle WebLogic Proxy Flaw for Emergency Patching

On August 24, 2026, CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities (KEV) catalog and ordered all Federal Civilian Executive Branch (FCEB) agencies to apply fixes by August 27. Consequently, this marks one of the shortest patching deadlines CISA has issued under Binding Operational Directive 26-04.

The vulnerability affects the Oracle WebLogic Server Proxy Plug-in — the reverse-proxy component that routes web traffic from front-end HTTP servers to backend WebLogic application servers. Furthermore, versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 of the Apache plug-in, along with version 12.2.1.4.0 of the IIS plug-in, are vulnerable. Oracle released patches in its January 2026 Critical Patch Update, yet exploitation has continued for seven months.

Technical Details of the CVE-2026-21962 Vulnerability

CVE-2026-21962 is not a flaw in WebLogic Server itself. Instead, it resides in the proxy plug-in that sits in front of it — the component most exposed to the public internet. Therefore, attackers can exploit it before any WebLogic-side authentication occurs.

The root cause is a URI normalization inconsistency between Oracle HTTP Server’s proxy layer and the backend WebLogic server. In other words, the two components interpret the same URL differently. The proxy plug-in is configured to block requests to protected internal endpoints such as /bea_wls_internal/. However, an attacker can craft a path-traversal HTTP request like /_proxy//weblogic/..;/bea_wls_internal/ProxyServlet. The front-end proxy sees ..; and treats the semicolon as a path parameter delimiter, routing the request as if it were destined for a permitted location. Meanwhile, the backend WebLogic server resolves the actual destination as the privileged ProxyServlet and allows it.

The CVSS 3.1 vector — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N — explains the perfect score:

• Attack Vector (AV): Network — exploitable remotely via HTTP
• Attack Complexity (AC): Low — no special conditions needed
• Privileges Required (PR): None — no credentials needed
• User Interaction (UI): None — no clicks or social engineering
• Scope (S): Changed — impact cascades beyond the proxy to backend applications
• Confidentiality (C): High — unauthorized access to all data
• Integrity (I): High — unauthorized creation, deletion, or modification

Exploitation Timeline and Proof-of-Concept

A working proof-of-concept exploit was published on GitHub on January 22, 2026 — just two days after Oracle’s patch was released. Security researcher gregk4sec had identified the path-traversal vector as early as September 24, 2025. CloudSEK deployed a high-interaction honeypot simulating a vulnerable Oracle WebLogic Server (version 14.1.1.0.0) from January 22 through February 3, 2026. The first exploitation attempt arrived the same day the public proof-of-concept dropped. Over those 12 days, CloudSEK recorded more than 140,000 attack attempts from 21 countries.

Business and Operational Impact

The real-world consequences of CVE-2026-21962 extend far beyond a single software component. Because the flaw carries a scope change, a successful attack can cascade into the backend WebLogic applications that the proxy protects.

• Government networks compromised: SOCRadar documented a China-linked threat actor — assessed as linked to groups UNC5174 and UNC6586 — using CVE-2026-21962 as part of an 11-exploit chain targeting government infrastructure across 100+ countries.
• Healthcare and commercial sectors hit: The same campaign targeted healthcare organizations and commercial enterprises, delivering the SNOWLIGHT downloader malware.
• Widespread automated scanning: CloudSEK characterized the attack pattern as “widespread automated scanning and exploitation attempts” using rented VPS infrastructure from providers like HOSTGLOBAL.PLUS LTD and DigitalOcean.
• Multi-target tooling: In February 2026, a single IP address was observed simultaneously exploiting CVE-2026-21962 alongside vulnerabilities in Ivanti Endpoint Manager Mobile, GNU InetUtils, and GLPI.

Organizations running internet-facing Oracle WebLogic proxy components without the January 2026 patch remain fully exposed. Furthermore, the lack of authentication requirements means any attacker with network reach can exploit the flaw.

Mitigation and Recommendations

Administrators must treat CVE-2026-21962 as a critical priority. The following steps provide a clear remediation path.

Immediate Actions for Defenders

1. Apply Oracle’s January 2026 Critical Patch Update immediately. Install patches for all affected WebLogic Server Proxy Plug-in and Oracle HTTP Server instances. Prioritize internet-facing systems first.
2. Restrict network access to affected proxy ports. If patching cannot be completed immediately, limit access to trusted sources only. Isolate edge proxy hosts from backend WebLogic clusters.
3. Hunt for signs of exploitation. Review web server and proxy logs for anomalous HTTP requests directed at the WebLogic Server Proxy Plug-in. Investigate unexpected data creation, deletion, or modification.
4. Monitor for SNOWLIGHT indicators. The China-linked campaign delivered SNOWLIGHT malware. Review Sysdig’s SNOWLIGHT analysis and SOCRadar’s campaign reporting for IOCs.

Long-Term Hardening Measures

Organizations should also take steps to prevent similar incidents in the future. First, maintain an accurate inventory of Oracle Fusion Middleware components. Second, ensure management and proxy interfaces are not needlessly exposed to untrusted networks. Third, implement continuous vulnerability scanning for internet-facing edge components. Finally, establish rapid patch deployment procedures for critical security updates.

Bottom line: CVE-2026-21962 is a perfect-storm vulnerability — unauthenticated, remotely exploitable, with scope-change impact that reaches backend systems. If your organization runs affected Oracle WebLogic proxy components and has not applied the January 2026 patch, you are exposed to active exploitation right now. Patch immediately.

Incident Summary

CVE ID / Incident:	CVE-2026-21962
Affected Systems:	Oracle HTTP Server; Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) and Microsoft IIS (version 12.2.1.4.0)
Disclosure Date:	January 2026 (Oracle CPU); August 24, 2026 (CISA KEV addition)
Patch Status:	Available since Oracle January 2026 Critical Patch Update
CVSS Score:	10.0 (Critical)
CISA KEV Due Date:	August 27, 2026
Threat Actor:	China-linked groups UNC5174 and UNC6586
Associated Malware:	SNOWLIGHT downloader

References

1. CISA, “CISA Adds One Known Exploited Vulnerability to Catalog,” August 24, 2026, https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog, accessed August 28, 2026.
2. Hive Pro Threat Advisory, “CVE-2026-21962: Critical Oracle WebLogic Proxy Plug-in Flaw Exploited in the Wild,” https://www.hivepro.com/threat-advisory/cve-2026-21962, accessed August 28, 2026.
3. Security Affairs, “U.S. CISA Adds Maximum-Severity Oracle Flaw to Its Known Exploited Vulnerabilities Catalog,” https://securityaffairs.com/197801/security/u-s-cisa-adds-maximum-severity-oracle-flaw, accessed August 28, 2026.
4. The Hacker News, “Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data,” August 25, 2026, https://thehackernews.com/2026/08/actively-exploited-oracle-weblogic-flaw.html, accessed August 28, 2026.
5. Tech Times, “Oracle Proxy Flaw CVE-2026-21962 Fueled China-Linked Attacks on 100+ Governments,” August 26, 2026, https://www.techtimes.com/articles/325583/20260826/oracle-proxy-flaw-cve-2026-21962, accessed August 28, 2026.
6. CloudSEK, “Honey for Hackers: A Study of Attacks Targeting CVE-2026-21962,” https://www.cloudsek.com/blog/honey-for-hackers, accessed August 28, 2026.
7. SOCRadar, “Tracing SNOWLIGHT: A Government-Targeted Chinese Campaign,” https://socradar.io/blog/snowlight-government-chinese-campaign/, accessed August 28, 2026.
8. NIST NVD, “CVE-2026-21962 Detail,” https://nvd.nist.gov/vuln/detail/CVE-2026-21962, accessed August 28, 2026.