Oracle WebLogic CVE-2026-21962 (CVSS 10) Actively Exploited, CISA KEV Listed

Tue, 25 Aug 2026 11:39:54 +0000

Engineer — Act: CISA KEV listed, CVSS 10.0, public PoC on GitHub, and active exploitation confirmed — all signals align for emergency patching. Apply Oracle’s patch for CVE-2026-21962 on all Oracle HTTP Server and WebLogic Server instances immediately; treat as an out-of-cycle emergency change.
SOC/IR — Act: Active exploitation is confirmed via CISA KEV; the unauthenticated HTTP attack vector means exploit attempts are visible at the network layer. Hunt for anomalous unauthenticated HTTP requests to WebLogic management and listener ports since the KEV listing date, and tune SIEM/WAF rules for CVE-2026-21962 exploitation patterns.
Leader — Act: A maximum-severity, actively-exploited Oracle middleware flaw in CISA KEV warrants same-week leadership attention for any org running WebLogic in regulated or customer-facing environments. Confirm whether Oracle WebLogic or Oracle HTTP Server is in your environment, verify emergency patching is in motion, and prepare a brief for leadership if these systems support critical workloads.
Signals: CVE-2026-21962 — CISA KEV: listed, EPSS 0.43, public PoC on GitHub

Unauthenticated-Rce on CuraSec