[HIGH PRIORITY] Oracle WebLogic & OHS Improper Access Control (CVE-2026-21962)

⚠ HIGH PRIORITY — CISA KEV (Aug 24, 2026). CVSS 10.0. CVE-2026-21962 is an improper-access-control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Attackers create, delete, or modify access to critical data — potentially complete access to all data on affected middleware hosts. Federal remediation deadline: 27 Aug 2026 (3-day window).

Affected Oracle

• Oracle HTTP Server and WebLogic Server Proxy Plug-in
• WebLogic versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 (before January 2026 CPU)
• Internet-facing OHS reverse-proxy to WebLogic on Linux/Windows

Check patch level

cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i 2026
java weblogic.version
curl -sk https://host:7001/console | head -5

Patching Method

1. Download January 2026 (or later) Oracle Critical Patch Update from My Oracle Support.
2. Stop WebLogic AdminServer and managed servers (or use Zero Downtime Patching in clusters).
3. Apply CPU patch via OPatch: opatch apply <patch_id> in ORACLE_HOME.
4. Verify with opatch lsinventory — confirm 2026 CPU patch ID present.
5. Restart OHS and WebLogic; test proxy plug-in connectivity.
6. Review WebLogic and OHS logs for unauthorized data access before patch date.
7. Rotate WebLogic admin, datasource, and LDAP bind passwords post-patch.

export ORACLE_HOME=/u01/oracle/middleware
cd $ORACLE_HOME/OPatch && ./opatch lsinventory

Until patched

• Restrict OHS/WebLogic management ports to jump-host IP allowlist
• Block internet access to WebLogic console (7001) and OHS (443/80)
• Assume compromise if internet-facing and unpatched since Jan 2026 disclosure

CVSS: 10.0 Critical. CISA 3-day deadline — patch today.