CVE-2026-21962

What is the Oracle WebLogic Server Proxy Plug-in / Oracle HTTP Server?

Oracle HTTP Server (OHS) is Oracle's Apache-based web server, and the WebLogic Server Proxy Plug-in is a module for Apache HTTP Server and Microsoft IIS that forwards incoming HTTP requests from a front-end web server to back-end Oracle WebLogic Server instances. This proxy tier is the internet-facing front door to many enterprise Java application deployments. Because it sits in front of WebLogic — a perennial target for attackers — a flaw that lets requests bypass access controls at the proxy exposes the entire back-end application and its data.

Overview

CVE-2026-21962 is an improper-access-control vulnerability (CWE-284) in Oracle HTTP Server and the WebLogic Server Proxy Plug-in. The proxy fails to adequately authenticate the identity or permissions of requests as it parses and forwards them to back-end WebLogic, allowing a remote, unauthenticated attacker to send crafted HTTP requests that bypass access controls and reach or manipulate protected back-end resources. It carries a maximum CVSS base score of 10.0 with a Changed scope — the vulnerable proxy component grants access to the separately-protected WebLogic back end. Impact spans unauthorized creation, deletion, or modification of critical data and full read access to all data reachable through the proxy.

Affected Versions

Technical Details

The proxy component does not correctly enforce authentication/authorization when handling and relaying requests to the WebLogic back end, so an attacker can craft HTTP requests that the proxy forwards as if authorized, bypassing intended access controls. The vulnerability is unauthenticated and low-complexity (AV:N/AC:L/PR:N/UI:N), and its Changed scope (S:C) — combined with high confidentiality and integrity impact — is what drives the 10.0 score. Oracle has not published the precise bypass primitive; public analyses characterize it as an access-control failure in proxy request handling. It is frequently chained with older, well-known WebLogic vulnerabilities to achieve deeper compromise.

Discovery

The vulnerability has not been publicly attributed to a named researcher; it was fixed in the Oracle January 2026 Critical Patch Update. In-the-wild activity was subsequently reported by GreyNoise, CloudSEK, and SOCRadar.

Exploitation Context

Exploitation is confirmed in the wild and has been attributed to a China-linked threat actor delivering the SNOWLIGHT downloader. Attackers chain CVE-2026-21962 with older WebLogic flaws — CVE-2020-14882/14883, CVE-2020-2551, and CVE-2017-10271 — to reach and exploit back-end WebLogic. CloudSEK honeypots captured related activity as early as March 2026, with initial exploitation attempts observed around February 2026 — well before the KEV listing — underscoring that patching this January 2026 CPU issue is overdue for exposed systems.

Remediation

1. Apply the Oracle January 2026 Critical Patch Update for all affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) of Oracle HTTP Server and the WebLogic Server Proxy Plug-in, on both Apache and IIS front ends.
2. Also patch the back-end WebLogic servers against the older chained CVEs (CVE-2020-14882/14883, CVE-2020-2551, CVE-2017-10271) if any remain unaddressed.
3. Restrict internet exposure of the proxy tier and WebLogic admin/console endpoints; place them behind network controls and do not expose management interfaces publicly.
4. Hunt for compromise on exposed, unpatched systems: look for SNOWLIGHT downloader indicators, anomalous proxied requests, and signs of exploitation of the chained WebLogic CVEs, given exploitation predates the KEV listing by months.
5. Rotate credentials and review data integrity for back-end applications reachable through the proxy if compromise is suspected.