Oracle Health threat report

CVE-2026-21962, a maximum-severity improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in (CVSS 10.0), has been added to CISA's Known Exploited Vulnerabilities catalog following confirmed active exploitation. The vulnerability allows unauthenticated attackers with network access via HTTP to unauthorizedly access, modify, or delete critical data. Patches were released in January 2026, and exploitation attempts have been documented by GreyNoise and CloudSEK.

• Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Att(opens in a new tab)
• Hackers Exploit Critical Oracle HTTP Server Flaw to Access and M(opens in a new tab)
• CISA Warns of Exploited Oracle WebLogic Vulnerability - Security(opens in a new tab)
• U.S. CISA adds maximum-severity Oracle flaw to its Known Exploit(opens in a new tab)
• Oracle Proxy Flaw CVE-2026-21962 Fueled China-Linked Attacks on (opens in a new tab)
• A Maximum-Severity Oracle WebLogic Flaw Is Being Exploited Right(opens in a new tab)