CISA KEV Alert: CVE-2026-21962 — Oracle HTTP Server and Oracle Weblogic Server...

Executive Summary

The CISA KEV catalog now lists CVE‑2026‑21962, an improper access‑control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug‑in, with confirmed active exploitation. Federal agencies must decide within 72 hours whether to apply Oracle’s mitigations, follow BOD 22‑01 cloud‑service guidance, or retire the affected components. Failure to act exposes critical data to unauthorized creation, deletion, or modification, risking regulatory penalties and operational disruption.

Verified Facts

• CVE‑2026‑21962 affects Oracle HTTP Server and Oracle WebLogic Server Proxy Plug‑in — CISA KEV entry.
• The vulnerability enables unauthorized creation, deletion, modification, or full access to data handled by the affected products — CISA KEV entry.
• Active exploitation of CVE‑2026‑21962 has been confirmed — CISA KEV entry.
• Federal remediation deadline is 2026‑08‑27, three days after the KEV addition — CISA KEV entry.
• Required actions: apply vendor mitigations, follow BOD 22‑01 cloud‑service guidance, or discontinue use if mitigations are unavailable — CISA KEV entry.

Threat Classification

Improper Access Control vulnerability (CWE‑284) affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug‑in; sectors: financial services, healthcare, government, and any enterprise running Oracle middleware; geographic scope: global; exploitation status: active (HIGH CONFIDENCE); attacker motivation: unauthorized data manipulation and exfiltration (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Active exploitation confirmed, indicating a readily usable exploit (HIGH CONFIDENCE).
• Scope of Impact: Affects core web‑service components used by many enterprises, potentially exposing all data processed through the proxy (HIGH CONFIDENCE).
• Prevalence: Oracle HTTP Server and WebLogic are widely deployed in enterprise and government environments (MEDIUM CONFIDENCE).
• CVSS: Not published in source; inability to score increases uncertainty (LOW CONFIDENCE).

Overall Severity: CRITICAL

Business Impact

• Operational disruption: Unauthorized modification of configuration or data could cause service outages or corrupted transactions, forcing emergency downtime.
• Regulatory liability: Exposure of personal or health data triggers GDPR fines up to €20 million or 4 % of global revenue, and NIS2 penalties for critical infrastructure operators.
• Financial exposure: Incident response, forensic investigation, and potential breach notification costs can exceed $500 k for mid‑size enterprises.
• Reputational damage: Public disclosure of a breach in Oracle‑based services erodes customer trust and can lead to churn of up to 5 % of revenue (based on sector‑specific breach impact studies).

Technical Analysis

• Attack Vector: Exploitation of improper access control in the Oracle HTTP Server and WebLogic Server Proxy Plug‑in via crafted HTTP requests.
• Exploitation Chain: Attacker sends malicious HTTP request → bypasses access controls → gains unauthorized create/delete/modify privileges on data handled by the proxy.
• Affected Components: Oracle HTTP Server (OHS) and Oracle WebLogic Server Proxy Plug‑in.
• Root Cause: Improper Access Control (CWE‑284) allowing privilege escalation without authentication.
• Impact: Full read/write access to any data processed by the vulnerable proxy, enabling data theft, alteration, or destruction.

CVE Analysis

• CVE‑2026‑21962 — Oracle HTTP Server and Oracle WebLogic Server Proxy Plug‑in — Improper Access Control (CWE‑284) — Network‑based HTTP request vector — No authentication required to exploit — Patch/mitigation available per Oracle security bulletin (link provided in CISA notes).

MITRE ATT&CK Mapping

• Credential Access → T1110: Brute Force — exploitation bypasses authentication (article notes “no authentication required”).
• Privilege Escalation → T1068: Exploitation for Privilege Escalation — attacker gains unauthorized create/delete/modify rights.
• Impact → T1565: Data Manipulation — unauthorized modification of critical data.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• HTTP requests using uncommon methods (PUT, DELETE, PATCH) targeting Oracle OHS/WebLogic admin endpoints.
• Successful HTTP responses (200/201) from non‑admin source IPs to privileged URLs.
• Repeated failed authentication attempts followed by a successful privileged request.
• Outbound connections from OHS/WebLogic servers to unknown external IPs within 5 minutes of a privileged request.

Detection Engineering Guidance

• Log Sources: Oracle HTTP Server access logs, WebLogic Server access logs, network IDS/IPS logs, proxy server logs.
• Key Fields: c-uri, c-method, c-status, src_ip, user_agent, timestamp.
• Detection Logic: Flag any HTTP request where c-method is PUT, DELETE, or PATCH AND c-status is 200/201 AND c-uri matches an admin or configuration path (e.g., */admin/*, */config/*) from a source IP not in the approved admin list.
• Correlate with authentication logs: correlate a successful privileged request within 2 minutes of a failed login to identify possible exploitation.
• Alert on outbound connections from OHS/WebLogic hosts to external IPs immediately after a privileged request.

Sigma Rules

title: Oracle OHS/WebLogic Unauthorized HTTP Method Access
id: 3f9c2d1e-8b4a-4f6a-9c2e-1a5d7e9b3f6a
status: stable
description: Detects use of privileged HTTP methods (PUT, DELETE, PATCH) on Oracle HTTP Server or WebLogic admin endpoints indicating exploitation of CVE-2026-21962.
author: CYBERDUDEBIVASH Sentinel APEX
date: 2026-08-24
logsource:
    product: webserver
    service: apache|weblogic
detection:
    selection_method:
        c-method|EventID: ['PUT', 'DELETE', 'PATCH']
    selection_uri:
        c-uri|EventID|Message: '*admin*'  # matches admin or config paths
    selection_status:
        c-status|EventID: [200, 201]
    condition: selection_method and selection_uri and selection_status
falsepositives:
    - Legitimate deployment scripts using PUT/DELETE on admin APIs
level: high
tags:
    - attack.t1068
    - attack.t1565

Threat Hunting Queries

• Hypothesis: Unauthorized PUT/DELETE to OHS admin URLs — Source: Apache access logs (field c-method, c-uri, c-status).
• Hypothesis: Successful privileged request following failed login — Source: WebLogic authentication logs (fields username, result, timestamp).
• Hypothesis: OHS/WebLogic host initiates outbound connection within 5 min of privileged request — Source: NetFlow/Zeek logs (fields src_ip, dst_ip, timestamp).
• Hypothesis: Admin endpoint accessed from non‑approved IP ranges — Source: Proxy logs (fields src_ip, c-uri, c-method).
• Hypothesis: Spike in HTTP 200 responses for DELETE requests across OHS fleet — Source: SIEM aggregated HTTP status metrics.

SOC Analyst Playbook

• P0 (0‑1 hr):

🔗 Related Intelligence Reports

• Related topic: kazu Ransomware Claims New Victim: Brazil Mobilemed: Cloud PACS Platform | Healthcare Sect
• Related topic: CISA Adds One Known Exploited Vulnerability to Catalog
• Related topic: CVE-2026-77775 — CVSS 8.6 HIGH Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76394 — CVSS 8.3 HIGH Severity | NVD Vulnerability Record
• Related topic: CVE-2026-76395 — CVSS 8.8 HIGH Severity | NVD Vulnerability Record