CVE-2026-21962

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server versions 12.2.1.4.0 through 14.1.2.0.0 Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server versions 12.2.1.4.0 through 14.1.2.0.0 Oracle WebLogic Server Proxy Plug-in for IIS version 12.2.1.4.0

Description An improper access control issue exists in the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. This flaw allows an unauthenticated remote attacker to compromise the system via specially crafted HTTP requests, potentially leading to unauthenticated Remote Code Execution (RCE). Successful exploitation enables the attacker to create, modify, or delete critical data, or gain complete access to all data accessible through the affected components. The issue has been actively exploited in the wild, with reports of automated scanning and targeting of government infrastructure by APT groups. Technical exploitation involves path traversal to the ProxyServlet function and the use of specific HTTP headers such as WL-Proxy-Client-IP, Proxy-Client-IP, and X-Forwarded-For to pass base64-encoded shell commands. Vulnerable API endpoints include '/weblogic/', '/wl proxy/', '/bea wls internal/', '/ proxy/', and '/proxy/'.

Recommendations Apply the Oracle Critical Patch Update from January 2026 for Oracle HTTP Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Apply the Oracle Critical Patch Update from January 2026 for Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Apply the Oracle Critical Patch Update from January 2026 for Oracle WebLogic Server Proxy Plug-in for IIS version 12.2.1.4.0. Restrict access to WebLogic administrative consoles and proxy endpoints by using a VPN, bastion host, or firewall allowlists to prevent public internet exposure. Implement WAF rules to block HTTP requests containing path traversal sequences (e.g., ..;) targeting the ProxyServlet or the aforementioned vulnerable endpoints. Monitor system logs for suspicious outbound connections or the execution of commands such as wget, curl, nc, and bash -i.