Vulnerability in Oracle Http_server
CVE-2026-21962
Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions…
EPSS: 0.427 (98.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Oracle Http_server — versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
- Oracle Weblogic_server_proxy_plug-in — versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
- Oracle Corporation Http Server, Weblogic Server Proxy Plug-in — versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert_us@oracle.com (vendor-advisory, Patch, Vendor Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Not Applicable)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Not Applicable)
Frequently asked questions
- What is CVE-2026-21962?
- CVE-2026-21962 is a critical-severity vulnerability in Oracle Http_server, classified under Improper Access Control. CVSS score: 10.0/10. Published 2026-01-20.
- How severe is CVE-2026-21962?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2026-21962 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.