KEV Entry

CVE-2026-21962

Known Exploited Vulnerability Entry CISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-21962

2026-08-24 00:00 UTC

Timestamps

2026-08-24

2026-08-24

Scope

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | Affected: Oracle / HTTP Server and Oracle Weblogic Server Proxy Plug-in | Description: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-08-27 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.oracle.com/security-alerts/cpujan2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21962

References
  • {'id': 'CVE-2026-21962', 'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21962'}

ba2de698-3090-4784-bb90-39ef7f0219d7

CISA
405284c2-e461-4670-8979-7fd2c9755a60

2026-08-24 19:00 UTC

2026-08-24 19:00 UTC

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
vendor_report cisa-kev successful_exploitation 0.80
View details 
{
  "cwes": [
    "CWE-284"
  ],
  "date_added": "2026-08-24",
  "due_date": "2026-08-27",
  "feed": "CISA Known Exploited Vulnerabilities Catalog",
  "knownRansomwareCampaignUse": "Unknown",
  "product": "HTTP Server and Oracle Weblogic Server Proxy Plug-in",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability"
}
 -
Export Options
JSON Object JSON API View Full Catalog