A CVSS 10 Oracle WebLogic bug that lives between two parsers

Somewhere in the federal civilian estate this morning, a Fusion Middleware owner is staring at a Monday email from CISA and doing math. The KEV update that landed on August 24, 2026 adds CVE-2026-21962 with a BOD 22-01 due date of August 27. That gives FCEB agencies about three days to patch a component many of them do not know is enabled, running in front of applications the security team probably does not own. BankInfoSecurity called it one of the tightest KEV clocks CISA has issued.

The bug is a CVSS 10.0 authentication bypass in the Oracle HTTP Server and WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS. The Oracle January 2026 CPU advisory gives it a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. No credentials, no user interaction, network reachable, scope changed. The scope change is the tell: the flaw sits inside the plug-in but the damage lands elsewhere.

How the KEV entry got there

Oracle disclosed the flaw on January 20, 2026 in the quarterly CPU (SOCRadar summary). Two days later researcher gregk4sec published a proof of concept to gregk4sec/CVE-2026-21962. CloudSEK's high-interaction Oracle honeypot logged automated exploitation the same day, and the twelve days that followed were dominated by libredtail-http and Nmap Scripting Engine probes. SecurityWeek and The Hacker News both flagged a suspected China-linked actor using the flaw against government infrastructure in July. The catalog entry is not preemptive. Somebody is already using this.

Where the two parsers disagree

The WebLogic Server Proxy Plug-in lets an Apache HTTP Server or IIS front-end accept requests and hand the servlet-bound ones to a WebLogic backend. Every request forces a routing decision: static asset the front-end serves directly, or dynamic path that goes to WebLogic. The URI decides, and the URI passes through two parsers that do not agree.

The front-end parser is Apache's, with the plug-in on top. It decodes and normalizes the path, then decides whether the location matches a proxy pattern that requires auth or a static-file rule that does not. The backend parser is WebLogic's, inside the servlet container after the request is forwarded. It runs its own decoding pass and its own normalization to resolve the servlet mapping. When those two passes land on different final paths for the same input, the request has already crossed the trust boundary. The front-end concluded the URI pointed at something harmless. The backend resolved the same bytes to an authenticated servlet. No auth token was ever checked.

Gridinsoft summarizes it as "path-traversal elevation of privilege caused by URI normalization inconsistency between Oracle OHS with default configuration and the backend WebLogic server." Percent-encoded traversal does most of the work: %2E%2E%2F decodes to ../. If the front-end matches the pre-decoded prefix against a static-content Location block, the request looks like an image or a script bundle. When the backend decodes and normalizes what it received, it climbs out of the pretend static directory and lands on a real servlet, including administrative endpoints. The older console traversal at CVE-2020-14882 used the same shape at /console/images/%2E%2E%2Fconsole.portal. CVE-2026-21962 moves the disagreement out of the console app and into the proxy layer, which is why the CVSS vector marks scope changed.

Public sources have not published the exact byte pattern Oracle's January patch corrected, and honeypot data focuses on scanner traffic rather than payload transcripts. Treat any unpatched OHS or Weblogic Proxy Plug-in reachable from an untrusted network as unauthenticated to its backend.

Why a CVSS 10 still gets buried in the queue

A perfect ten should be the easiest queue call in the world, and it often is not. Fusion Middleware inventories are messy. The Proxy Plug-in is a bundled component, so the affected asset is usually described as "Oracle HTTP Server" or "WebLogic" in the CMDB with no version string that maps cleanly to the CPU column. Scanners fingerprint the front-end web server and the backend container separately and produce two findings for the same box that never refer back to each other. A CVSS-first queue then sorts by base score with no idea whether the proxy is enabled, whether it faces the internet, or whether the backend behind it is a stub development app or the identity federation for the whole enterprise. Two OHS instances share the same 10.0 finding and represent radically different risk. The queue moves them together anyway.

The TRIS layers behind an ACT verdict on a Fusion Middleware box

TRIS, the Threat and Risk Intelligence Scoring engine inside CVEasy AI, walks a few layers on top of the raw CVSS input before it lands on a band. Four of them decide the verdict for CVE-2026-21962 on a given asset.

Exploitation signal. Four inputs land in the same layer: the KEV entry from August 24, a public PoC that has lived at gregk4sec/CVE-2026-21962 since January 22, CloudSEK honeypot telemetry showing automated scanning within hours of that publication, and a distinct campaign SOCRadar attributed to a suspected China-linked actor in July. The engine reads that mix as top-tier exploitation pressure, while still keeping mass-scanner traffic and named-victim compromise on separate rails.

Exposure surface. The plug-in is only reachable if the reverse proxy is listening on a network the attacker can reach. TRIS asks whether the OHS or Apache instance is on a public interface, whether it sits behind a WAF fingerprinting the KEV templates, and whether the Location blocks actually route to WebLogic. An internet-facing OHS in front of PeopleSoft or SOA Suite scores near the ceiling. A lab OHS on a private VLAN with the proxy directives commented out sits far lower.

Business criticality of the backend. A WebLogic backend hosting an identity provider or a Fusion admin console is a different loss than a marketing microsite, so TRIS pulls asset criticality from the inventory graph and lets the same CVE land differently on those two backends.

Blast radius and lateral pivot. Scope changed means the compromise reaches beyond the plug-in process. A hijacked backend request can invoke servlets that write to disk, deploy applications, or issue T3 calls to peer managed servers. TRIS credits assets inside those blast-radius zones alongside a critical exposed instance.

The output is not a bigger number than CVSS. It is the same CVE-2026-21962 finding landing top-band ACT on an internet-facing OHS in front of a Fusion identity stack and landing far lower on a sandboxed development instance, without either operator having to justify why they moved the number.

Patch, restrict, hunt: what to do before the KEV clock hits zero

• Apply the January 2026 CPU on every affected plug-in. Weblogic Server Proxy Plug-in for Apache HTTP Server at 12.2.1.4.0, 14.1.1.0.0, or 14.1.2.0.0, and Weblogic Server Proxy Plug-in for IIS at 12.2.1.4.0. Confirm patch level from the plug-in binary, not from the WebLogic managed server version. The two can drift.
• Restrict the listener while you schedule the window. If you cannot patch inside the KEV deadline, block direct internet reach to the OHS or Apache listener until the patch is applied and the front-end process has been restarted.
• Preserve HTTP and WebLogic logs before rotation. Hunt for percent-encoded traversal fragments (%2E%2E%2F, %252E%252E%252F) in request paths, unauthenticated requests for administrative endpoints, and any unexpected servlet invocations in backend logs.
• Rotate credentials the compromised path could have reached. WebLogic administrator credentials, deployment tokens, JMS secrets, and weblogic-jdbc data source credentials in config.xml on any unpatched, reachable backend during the exposure window are untrusted.
• Confirm the plug-in is enabled before declaring victory. The Fusion Middleware install carries the binaries even when they are not wired up. The KEV clock only bites where the plug-in is running and reachable.

Where CVEasy AI puts this on your queue

CVEasy AI, the number one local-first CTEM platform, ingests the Oracle CPU advisory, the CISA KEV entry, the CloudSEK honeypot telemetry, and the public PoC repository as first-class exploitation inputs. TRIS then scores CVE-2026-21962 against your actual inventory, matches OHS and WebLogic Proxy Plug-in binaries by build string, and joins them to the backend they front. An internet-reachable OHS in front of a business-critical Fusion app lands top-band ACT with the KEV deadline, the proxy-directive evidence, and the backend criticality cited on the finding. A dormant plug-in on a lab instance sits lower, still tracked. The scoring and inventory join stay on your hardware, because the inputs that make a CVSS 10 finding actionable are the ones you would rather not ship to a vendor cloud.

Sources: CISA KEV, Oracle CPU January 2026, SOCRadar, CloudSEK, SecurityWeek, The Hacker News, BankInfoSecurity, Gridinsoft, gregk4sec PoC, CVE-2020-14882 reference.