CVE-2026-21962 hits CISA KEV seven months after the patch

CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24. It is a CVSS 10.0 in the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. Oracle patched it in January. The interesting number here is not 10.0 — it is the seven months between the fix and the confirmation that somebody is using it.

What actually happened

CISA's August 24 alert added one CVE on evidence of active exploitation: an improper access control flaw in Oracle's proxy plug-in. Unauthenticated, remote, over HTTP. Path traversal and header manipulation let an attacker walk past the proxy's access controls and reach the backend WebLogic instances the proxy was supposed to be guarding.

The timeline, per NetSPI's analysis and Field Effect's writeup: Oracle shipped the fix in its January 20, 2026 Critical Patch Update. A public proof-of-concept existed by January 21. The SANS Internet Storm Center saw probing for malformed traversal sequences and injected headers against WebLogic paths by January 28. Affected versions are 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, plus the IIS proxy plug-in at 12.2.1.4.0.

So: patch Tuesday, PoC Wednesday, scanning inside two weeks, KEV listing in August. Nothing in that sequence was a surprise to anyone reading. It still took seven months to produce a confirmed victim.

Why a seven-month patch gap matters for your business

Your DMZ is full of software nobody owns. Proxy plug-ins are the definition of infrastructure that got installed once and never assigned. It sits between the internet and the app server, which is exactly the position that makes an access-control bypass fatal, and exactly the position nobody puts on a maintenance calendar.

KEV is a lagging indicator, not an alarm clock. By the time CISA lists something, exploitation is already confirmed somewhere. If your patch process waits for KEV, you are choosing to be seven months behind a public PoC. Use the CPU date as the deadline and treat KEV as the audit that tells you whether you met it.

"We don't run WebLogic" is not the same as "we don't run this." The plug-in ships for Apache and IIS. It gets installed by whoever set up the reverse proxy in front of an ERP or a legacy Oracle app, and the inventory line item says "web server," not "WebLogic." Grep your web server configs for the plug-in module before you conclude you are clear.

Sources: CISA KEV alert, August 24, 2026, NetSPI, Field Effect.