AI Weekly Malaysia

CISA added CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle's HTTP Server and WebLogic Server Proxy Plug-in (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) on Windows VMs, to its Known Exploited Vulnerability catalog with a three-day patching deadline. Oracle patched the bug in January 2026, but CISA only catalogued it seven months later despite honeypot evidence from CloudSEK showing active exploitation within days of disclosure.

Why: If you run Oracle WebLogic or HTTP Server on Windows in production, patch immediately—attackers were already probing this within days of the January disclosure, and successful exploitation grants complete data access. For everyone else not on the Oracle stack, this is a reminder that KEV catalog lag (seven months here) means you cannot wait for government mandates to drive patching timelines.

CISA added CVE-2026-21962 (CVSS 10.0), an unauthenticated improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog due to active exploitation. Oracle patched the flaw in January 2026, but GreyNoise and CloudSEK reported exploitation attempts as recently as March 2026, including against honeypots, alongside older WebLogic RCE flaws like CVE-2020-14882.

Why: Only relevant if you operate Oracle WebLogic or Oracle HTTP Server with the Proxy Plug-in in your stack; if so, confirm the January 2026 patch is applied immediately since active exploitation is confirmed. For the majority of this audience not running WebLogic, no action is needed.