As cited
Copy frozen at (site build).
vulnerabilities
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, indicating active exploitation. The flaw in Oracle HTTP Server and Oracle WebLogic Server has a maximum severity score of 10.0 and permits unauthenticated HTTP access to critical data.
Why it matters: Organizations running Oracle HTTP Server or Oracle WebLogic Server are exposed to remote, unauthenticated data access and should patch immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog, indicating active exploitation. The flaw in Oracle HTTP Server and Oracle WebLogic Server has a maximum severity score of 10.0 and permits unauthenticated HTTP access to critical data.
Why it matters: Organizations running Oracle HTTP Server or Oracle WebLogic Server are exposed to remote, unauthenticated data access and should patch immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 25, 2026, citing active exploitation. The flaw affects Oracle HTTP Server and Oracle WebLogic Server, with a CVSS score of 10.0. Unauthenticated attackers with network access can exploit the vulnerability via HTTP.
Why it matters: Organizations running Oracle WebLogic Server or Oracle HTTP Server face immediate risk from active attacks and must prioritize patching this maximum-severity, unauthenticated remote vulnerability.
- Source published
- First seen by Cybersecurity Tracker