Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in…

First seen: 24 Aug 2026
Last update: 24 Aug 2026, 12:00 UTC
Identifiers: CVE-2026-21962
KEV deadline: 2026-08-27
Source: CISA KEV
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in
Ids: CVE-2026-21962

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in…

## Steps
1. Search the repo, its CI and infra config for Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-21962") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-21962 https://www.oracle.com/security-alerts/cpujan2026.html
https://pwned.coffee/i/oracle-http-server-and-oracle-weblogic-server-proxy-plug-cve-2026-21962

Sources

Totalone hot coffee