Oracle WebLogic/HTTP Server unauthenticated data access via HTTP
Unauthenticated HTTP access exposes critical data on Oracle HTTP Server and WebLogic Server. CVSS 10.0. CISA added to KEV August 25, 2026; active exploitation confirmed.
- Vendor
- Oracle
- Product
- WebLogic Server / HTTP Server
- CVSS
- 10.0
- EPSS (exploit probability)
- 73.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-21962 being exploited?
Yes. CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 73.2% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-21962 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Unauthenticated attacker with network access via HTTP can access critical data on Oracle HTTP Server and Oracle WebLogic Server. No credentials required. No user interaction required.
CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 25, 2026, citing active exploitation. CVSS score: 10.0 — maximum possible severity.
Patch via Oracle’s Critical Patch Update advisory. Check Oracle Security Alerts for the current CPU containing the fix. If immediate patching is not possible, restrict HTTP access to WebLogic and HTTP Server admin interfaces from untrusted networks.
See coverage: Oracle WebLogic CVE-2026-21962 Added to CISA KEV.
Other Oracle WebLogic Server CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 74.2% | |
| CVE-2020-2883 Oracle WebLogic Server Unspecified Vulnerability | [ CRITICAL ] | 9.8 | 94.6% | |
| CVE-2020-14644 Oracle WebLogic Server Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 94.5% | |
| CVE-2017-3506 Oracle WebLogic Server OS Command Injection Vulnerability | [ HIGH ] | 7.4 | 96.0% | |
| CVE-2023-21839 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 99.9% | |
| CVE-2018-2628 Oracle WebLogic Server Unspecified Vulnerability | [ CRITICAL ] | 9.8 | 100.0% | |
| CVE-2017-10271 Oracle Corporation WebLogic Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 7.5 | 100.0% | |
| CVE-2019-2725 Oracle WebLogic Server, Injectionransomware use | [ CRITICAL ] | 9.8 | 100.0% |
