<![CDATA[🔴 Critical: Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data]]>CISA has added a maximum-severity vulnerability affecting Oracle HTTP Server and Oracle WebLogic Server to its Known Exploited Vulnerabilities (KEV) catalog, following confirmed reports of active exploitation. The flaw, tracked as CVE-2026-21962 with a CVSS score of 10.0, enables an unauthenticated attacker with network access via HTTP to compromise critical data.

  • Affected products: Oracle HTTP Server and Oracle WebLogic Server
  • Attack vector: unauthenticated, network-based via HTTP
  • Impact: unauthorized access to critical data

Given the active exploitation status, organizations running these products should treat this as a priority for immediate patching. CISA's KEV catalog inclusion is a strong signal that threat actors are actively leveraging this vector, so reviewing exposure and applying vendor-supplied updates promptly is advised.

Source: The Hacker News

Is your team already tracking this CVE in your patch cycle, or are you still assessing exposure across your WebLogic and HTTP Server instances?

]]>https://xploitlk.com/topic/93/critical-actively-exploited-oracle-weblogic-flaw-lets-unauthenticated-attackers-access-critical-dataRSS for NodeSat, 05 Sep 2026 14:22:37 GMTTue, 25 Aug 2026 08:30:24 GMT60