The cybersecurity agency CISA has instructed government organizations to immediately patch a critical vulnerability that has been widely exploited in attacks against Oracle WebLogic servers.
The remote code execution flaw, identified as CVE-2026-21962 with a CVSS score of 10, affects Oracle HTTP Server and the WebLogic Server Proxy plugin, which bridges HTTP Server to WebLogic.
The security hole can be exploited without authentication to hack affected servers. Oracle patched the vulnerability with its January 2026 updates.
CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities (KEV) catalog on August 24 and instructed federal agencies to address it by August 27.
[ Read: CISA Tells Federal Agencies to Prioritize Patches Based on Risk ]
While the KEV list is primarily designed for government agencies, all organizations can use it to prioritize patching, alongside other tools and resources.
It’s unclear which attacks triggered CISA’s alert for CVE-2026-21962. The vulnerability has been exploited since January, with the first attacks flagged by CloudSEK.
The security firm warned in March that its honeypots had seen exploitation attempts aimed at Oracle WebLogic servers since January 22, immediately after a PoC exploit was made public.
FalconFeeds mentioned the vulnerability’s exploitation in June, in a post describing the cybercrime supply chain. This was one of the several weaknesses exploited against enterprises, but not specific details were shared.
SOCRadar reported in July that CVE-2026-21962 had been one of the several vulnerabilities exploited by a China-linked threat actor in attacks targeting government infrastructure.
WebLogic servers are often targeted by hackers. CISA’s KEV catalog currently includes more than a dozen such vulnerabilities.
Related: 91 Vulnerabilities Patched in Spring Application Framework
Related: CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities
Related: Hackers Target Zimbra Servers in Active Exploitation Campaign