The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a three-day patching directive for a critical Oracle vulnerability, CVE-2026-21962, which has been actively exploited in the wild. This is CISA's most urgent deadline, requiring federal civilian executive branch (FCEB) agencies to apply patches by August 27.
The vulnerability, rated 10.0 on the CVSS scale, is an improper access control flaw (CWE-284) affecting Oracle's HTTP Server and WebLogic Server Proxy Plug-in on Windows virtual machines. Successful exploitation could allow attackers to create, delete, or modify critical data, potentially leading to complete access to all data on affected systems.
Oracle initially disclosed CVE-2026-21962 and released patches on January 20, 2026, as part of its regular updates. At that time, the company confirmed that versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 were affected, noting that the vulnerability was susceptible to low-complexity attacks.
CISA added CVE-2026-21962 to its Known Exploited Vulnerability (KEV) catalog on August 24. Despite the seven-month gap between disclosure and its inclusion in the KEV catalog, evidence from the private sector suggests that attackers began targeting the flaw shortly after its public disclosure.
For instance, a honeypot operated by CloudSEK cyber intelligence analyst Vikas Kundu recorded exploitation attempts against CVE-2026-21962 between January 22 and February 3, 2026. This period was immediately following the vulnerability's disclosure and the release of public exploit code. The honeypot also captured attempts to exploit other WebLogic remote code execution (RCE) vulnerabilities dating back to 2017 and 2020.
Kundu's observations indicated high-volume, automated scanning activity, with tools like libredtail-http and the Nmap Scripting Engine being prominent in the malicious traffic. The logs also revealed a broader "spray and pray" approach by threat actors, including attempts to exploit non-WebLogic-specific vulnerabilities such as Hikvision CVEs, PHPUnit RCEs, and generic command injections.
The findings from the honeypot underscored the immediate need for organizations to prioritize patching the vulnerability at the time of its initial disclosure. CISA has previously issued similar three-day deadlines for other critical vulnerabilities, including a remote code execution flaw in the Python scaling framework Ray, added to the KEV catalog last week despite being disclosed in 2025, and N-able's "god mode" vulnerability, which offered full administrative access to N-central consoles and was exploited as of July 31, according to the vendor.
