CVE-2026-21962

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

Published: 2026-01-20 Last update: 2026-02-03 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-21962 is rated Moderate Risk (42.6/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.03%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-21962

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-02-18 0.06% 0.03% -0.03%
2 2026-01-30 0.03% 0.06% +0.03%
3 2026-01-21 — 0.03% —

Full EPSS history (3 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-21962

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
10.0 3.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 5.8 [email protected]

Weakness enumeration for CVE-2026-21962

Affected software / configurations for CVE-2026-21962

Vendor Product Version Raw CPE
oracle http_server 12.2.1.4.0 cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
oracle http_server 14.1.1.0.0 cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:*
oracle http_server 14.1.2.0.0 cpe:2.3:a:oracle:http_server:14.1.2.0.0:*:*:*:*:*:*:*
oracle weblogic_server_proxy_plug-in 12.2.1.4.0 cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*
oracle weblogic_server_proxy_plug-in 14.1.1.0.0 cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*
oracle weblogic_server_proxy_plug-in 14.1.2.0.0 cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.2.0.0:*:*:*:*:*:*:*

References for CVE-2026-21962

cvelogic Threat Intelligence