CISA Adds Actively Exploited Oracle HTTP Server and WebLogic Proxy Plug-in Vulnerability to KEV Catalog

On August 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in. This addition is based on evidence of active exploitation, making it a high-priority concern for federal agencies and any organization using these Oracle products.

The vulnerability is described as an improper access control issue, a common attack vector that can allow malicious actors to bypass intended security restrictions. While specific technical details of the exploitation are not disclosed in the advisory, CISA's inclusion in the KEV Catalog confirms that threat actors are actively targeting this flaw.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize remediation of KEV-listed vulnerabilities, especially on publicly exposed assets that could grant total control of the system post-exploitation. The directive also mandates that agencies check for signs of compromise before applying patches. Although BOD 26-04 applies only to FCEB agencies, CISA strongly encourages all organizations to adopt similar risk-based vulnerability management practices.

CISA continues to accept nominations for additional vulnerabilities to the KEV Catalog through its nomination form, provided they meet the criteria of having a CVE ID, evidence of exploitation, and clear mitigation guidance.