As cited
Copy frozen at (site build).
vulnerabilities
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-21962, an Oracle HTTP Server and Weblogic Server proxy plug-in improper access control vulnerability, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. The vulnerability poses significant risk because it can grant total control of affected assets after exploitation. Federal agencies are required under Binding Operational Directive 26-04 to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed systems.
Why it matters: Organizations running Oracle HTTP Server or Weblogic Server with exposed proxy plug-ins must patch CVE-2026-21962 immediately, as it is actively exploited and grants complete post-exploitation control; federal agencies face compliance deadlines under BOD 26-04.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-21962, an Oracle HTTP Server and Weblogic Server proxy plug-in improper access control vulnerability, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. The vulnerability poses significant risk because it can grant total control of affected assets after exploitation. Federal agencies are required under Binding Operational Directive 26-04 to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed systems.
Why it matters: Organizations running Oracle HTTP Server or Weblogic Server with exposed proxy plug-ins must patch CVE-2026-21962 immediately, as it is actively exploited and grants complete post-exploitation control; federal agencies face compliance deadlines under BOD 26-04.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-21962, an Oracle HTTP Server and Weblogic Server proxy plug-in improper access control vulnerability, to its Known Exploited Vulnerabilities Catalog based on active exploitation evidence. The vulnerability poses significant risk because it can grant total control of affected assets after exploitation. Federal agencies are required under Binding Operational Directive 26-04 to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed systems.
Why it matters: Organizations running Oracle HTTP Server or Weblogic Server with exposed proxy plug-ins must patch CVE-2026-21962 immediately, as it is actively exploited and grants complete post-exploitation control; federal agencies face compliance deadlines under BOD 26-04.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CISA Adds One Known Exploited Vulnerability to Catalog
CISA added CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The vulnerability carries a CVSS score of 10.0 and grants total control of affected assets post-exploitation. Federal agencies must prioritize remediation under Binding Operational Directive 26-04, and CISA encourages all organizations to adopt risk-based vulnerability management focused on cataloged vulnerabilities.
Why it matters: Oracle HTTP Server and Weblogic Server users with publicly exposed instances must patch immediately, as this critical vulnerability is under active attack and grants full system compromise.
- Source published
- First seen by Cybersecurity Tracker