Oracle HTTP Server and WebLogic Proxy Plug-in Improper Access Control Added to CISA KEV

What's on the official record

CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities Catalog on 24 August 2026 (catalog version 2026.10.21). The vulnerability affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in and is an improper access control weakness (CWE-284) that can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to critical data, or complete access to all Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in data.

The catalog sets a remediation due date of 27 August 2026 for federal civilian agencies. The record names no fixed version; the required action points to the vendor advisory at https://www.oracle.com/security-alerts/cpujan2026.html. The catalog does not record known ransomware use.

FIRST's EPSS model estimates a 0.732 probability of exploitation (99th percentile, 2026-10-23); this is a model estimate, not observed exploitation. CISA's ADP SSVC assessment records exploitation as active, automatable, with total impact.

Assessment

For a platform or AI-stack owner, the record lets you check whether Oracle HTTP Server or the WebLogic Server Proxy Plug-in is present in your estate and whether the vendor advisory mitigations have been applied. The catalog's due date of 27 August 2026 is the federal remediation benchmark, and the absence of a named fixed version means the decision rests on the vendor advisory rather than a version threshold. You can decide to patch, isolate, or restrict the affected component until the advisory's mitigations are in place.

For a cyber underwriter, the record lets you check whether a policyholder's estate runs Oracle HTTP Server or the WebLogic Server Proxy Plug-in and whether the vendor advisory mitigations are applied. The catalog records active exploitation and total impact, which bears on pricing and control requirements for affected accounts. You can decide to require a control or adjust terms where the advisory mitigations are not yet applied.

What would change this call

A named fixed version from Oracle, or a change in the catalog's ransomware field, would change the remediation and underwriting picture.

What to check next

Confidence

Filed 25 October 2026 from the record dated 24 August 2026.

Sources

[1] Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-21962

[2] CVE record CVE-2026-21962 — https://www.cve.org/CVERecord?id=CVE-2026-21962

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog