CISA Flags Critical Oracle WebLogic Flaw as Attackers Hit Unpatched Servers

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-21962, a flaw in Oracle HTTP Server and Oracle WebLogic Server, to its Known Exploited Vulnerabilities catalog on Monday.
• The bug carries a CVSS score of 10.0, the highest possible rating, and can be triggered by an attacker over the internet with no login required.
• CISA says it has evidence the flaw is already being exploited in real attacks.
• Federal civilian agencies must patch affected Oracle systems by CISA's set deadline, and private organisations are strongly urged to do the same.

A critical flaw in widely used Oracle server software is being exploited in the wild, and the U.S. government wants it fixed fast.

The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog on Monday. That catalog is essentially a public list of security holes that attackers are actively abusing, and federal agencies are required to patch anything on it within a set window.

The flaw is tracked as CVE-2026-21962. It scores a perfect 10.0 on the CVSS severity scale, which runs from 0 to 10 and rates how dangerous a bug is. A 10 means it is about as bad as security flaws get.

What does the flaw actually let attackers do?

It lets a stranger on the internet break into vulnerable Oracle servers without needing a username or password. From there, they can reach data the server is supposed to protect.

The bug sits in two Oracle products: Oracle HTTP Server and Oracle WebLogic Server. Both are pieces of back-office software that big organisations use to run websites, business applications and internal systems. Banks, telcos, universities and government departments all use WebLogic somewhere in their stack.

Because the attack works over normal web traffic (HTTP), any vulnerable server exposed to the internet is reachable. No phishing, where criminals send fake emails to trick staff into handing over passwords, is required. The attacker just sends the right request.

Who is being targeted?

CISA has not named specific victims or the group behind the attacks. Its listing only confirms that exploitation is happening. The Hacker News first flagged the KEV addition on Monday.

Oracle WebLogic bugs have a long history of drawing in a mix of attackers. Financially motivated crews, including cryptomining crews and ransomware affiliates, tend to jump on them within days. So do state-linked groups: past WebLogic flaws have been used by clusters tracked as APT41 (Mandiant's naming) and by Iran-linked operators. It is too early to attribute this specific campaign, and single-source attribution should be treated with caution.

Capability and intent are separate questions here. The capability, remote unauthenticated access to sensitive data, is available to anyone who can write or buy a working exploit. Intent will vary by group.

What should organisations do now?

Patch, and check whether anyone got in already.

Admins should apply Oracle's fix from the latest Critical Patch Update as soon as possible. WebLogic servers should not be exposed directly to the public internet where it can be avoided; putting them behind a VPN or web application firewall cuts the attack surface. Log reviews going back several weeks are sensible, because attackers who broke in before the patch may have left backdoors behind.

Should ordinary customers worry?

Not directly, but keep an eye on notices from your bank, employer or service providers over the coming weeks. If an organisation you deal with was breached through this flaw, they may write to you about it. Treat any unexpected email asking you to "verify" an account with suspicion, and go to the company's website directly rather than clicking links.