Advisory · CVE-2026-21962
Oracle proxy mixup hands attackers the keys to the backend
A URI-normalization inconsistency between Oracle HTTP Server and the WebLogic proxy plug-in lets an unauthenticated attacker bypass access controls and reach or modify backend application data.
- Vendor
- Oracle
- Product
- Oracle HTTP Server
- Identifier / CWE
- CVE-2026-21962
CWE-284 - Action timing
- Sep 14, 2026
Explain it like I’m five
Two guards check visitor passes at a building, but they read handwriting differently. An attacker writes the room number in a squiggle the first guard ignores and the second guard reads, and walks into rooms that were supposed to be locked.
- 01Crafted request
An unauthenticated attacker sends an HTTP request with a URI containing an inconsistency such as /foo/..;/internal-path.
- 02Front-end allows it
Oracle HTTP Server or the WebLogic proxy plug-in does not normalize the URI the way the backend does, so front-end access rules miss the protected path.
- 03Backend normalizes
The backend WebLogic server interprets the path parameter and resolves the request to the protected resource.
- 04Controls bypassed
The attacker gains unauthorized access to, or can create, delete, or modify, data behind the proxy.
What happened
On August 24, 2026, CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog, citing active exploitation of an improper access control flaw in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. It carries the maximum CVSS 10.0 rating.
The proxy plug-in fronts backend WebLogic application servers from Apache HTTP Server or Microsoft IIS. A URI-normalization inconsistency between the front end and the backend means requests like /foo/..;/protected-path are evaluated differently at each layer: the front-end access control rules do not collapse the ..; sequence, while WebLogic treats the semicolon as a path parameter and resolves the parent reference. The result is an unauthenticated, network-accessible bypass of the access controls the proxy was supposed to enforce. Successful exploitation gives complete read access to data the proxy can reach plus unauthorized creation, deletion, or modification of critical data, with a CVSS scope of changed, meaning impact extends beyond the proxy into the backend systems.
Oracle patched the flaw in its January 2026 Critical Patch Update, covering Oracle HTTP Server and plug-in releases 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 (the IIS plug-in is affected only at 12.2.1.4.0). Despite the patch, exploitation efforts were observed by GreyNoise, CloudSEK, and SOCRadar, and the flaw is reported among vulnerabilities used by a China-linked actor delivering the SNOWLIGHT downloader. CISA gave federal agencies three days to remediate.
What to do
- Inventory Oracle HTTP Server and WebLogic Server Proxy Plug-in deployments, including bundled copies, and confirm whether the January 2026 CPU (or later) is applied.
- Apply the January 2026 Critical Patch Update or a later fixed release to every affected instance.
- Review proxy and backend access logs for crafted URIs containing
..;, encoded variants, or requests to protected paths that returned 200, to determine whether bypass attempts succeeded. - If exploitation is confirmed or cannot be ruled out, treat the backend WebLogic environment as compromised: rotate credentials and secrets, and review application data for unauthorized creation, modification, or deletion.
- Restrict direct network access to the proxy tier and confirm front-end access rules are re-tested against normalization-bypass variants after patching.
Management note
The proxy tier exists to be the enforcement point in front of your most important enterprise applications, and this flaw turns it into a decorative archway. It is a CVSS 10.0 with no authentication, no user interaction, and confirmed exploitation months after the patch shipped, which means the risk is not the patch, it is the instances nobody inventoried. Find every OHS and plug-in deployment first, then patch.