Actively Exploited Oracle WebLogic Vulnerability Exposes Critical Enterprise Data

A maximum-severity vulnerability affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in is being actively exploited, prompting an urgent warning from the US Cybersecurity and Infrastructure Security Agency and a compressed remediation deadline for federal agencies.

The vulnerability, tracked as CVE-2026-21962, carries a CVSS severity score of 10.0, the highest possible rating. It can be exploited remotely over HTTP without authentication, user interaction or prior access to the targeted environment.