CVE-2026-21962 is a critical vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 (IIS plug-in only 12.2.1.4.0). This easily exploitable vulnerability carries a CVSS v3.1 score of 10.0, indicating it can be exploited by unauthenticated attackers over the network via HTTP with low attack complexity. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as complete access to all accessible data within the affected products and potentially other systems. While there are no known public exploits or active exploitation, the vulnerability has garnered significant community discussion, suggesting high awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.2.1.4.0CPE matchmatch criteria | cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* | ||
14.1.1.0.0CPE matchmatch criteria | cpe:2.3:a:oracle:http_server:14.1.1.0.0:*:*:*:*:*:*:* | ||
14.1.2.0.0CPE matchmatch criteria | cpe:2.3:a:oracle:http_server:14.1.2.0.0:*:*:*:*:*:*:* | ||
12.2.1.4.0CPE matchmatch criteria | cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:* | ||
14.1.1.0.0CPE matchmatch criteria | cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.