Back to KEVs

CVE-2026-21962

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy...

Basic Information

CVE State
PUBLISHED
Reserved Date
January 05, 2026
Published Date
January 20, 2026
Last Updated
February 02, 2026
Vendor
Oracle Corporation
Product
Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in
Description
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

CVSS v3.1

10.0 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC Information

Exploitation
none
Automatable
Yes
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2026-02-13 12:00:09 UTC) Source
Proof of Concept Available
Yes (added 2026-01-26 09:33:54 UTC) Source

References

https://www.oracle.com/security-alerts/cpujan2026.html

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2026-02-13 12:00:09 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

ThumpBo/CVE-2026-21962

Type: github • Created: 2026-01-26 09:33:54 UTC • Stars: 3

CVE-2026-21962-EXP

boroeurnprach/Ashwesker-CVE-2026-21962

Type: github • Created: 2026-01-22 07:10:59 UTC • Stars: 5

CVE-2026-21962

samael0x4/CVE-2026-21962

Type: github • Created: 2026-01-22 03:59:25 UTC • Stars: 4

Unauthenticated vulnerability that may allow remote attackers to compromise confidentiality and integrity, potentially leading to full system compromise.

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Proof of Concept Exploit Available

  • Added to KEVIntel