CRITICAL

CVE-2026-21962

Oracle HTTP Server 2026-01-20 CVSS v3.1
CVSS
10
KEV

Description

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

Summary dbcve.org

Critical unauthenticated remote vulnerability in Oracle WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) allowing remote attackers to create, modify, or delete accessible data, plus full unauthorized read access to all data through the proxy. Exploitable via HTTP without authentication.

Mitigation

Apply Oracle Critical Patch Updates when available; until then, restrict network exposure of the proxy plug-in interfaces and monitor for unauthorized access attempts.

Patch Commit

Weakness (CWE)

CWE-284 Improper Access Control

EPSS Score

42.48%
Probability of exploitation in next 30 days
98.6th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE