CVE-2026-21962
Improper Access Control in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 24 August 2026.
- Product
- Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.
More from Oracle this year.
- CVE-2026-46817 Improper Privilege Management, added
- CVE-2026-35273 Missing Authentication for Critical Function, added
- CVE-2024-21182 Unspecified, added
- CVE-2025-61757 Missing Authentication for Critical Function, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.