WebLogic's Perfect-Score KEV Entry: CVE-2026-21962, a Three-Day Federal Deadline, and the Versions That Will Never Get the Patch
On August 24, CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog and gave US federal agencies until August 27 — three days, one of the shortest remediation windows the catalog has carried — to deal with it. The vulnerability sits in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in (the modules that front WebLogic behind Apache HTTP Server and IIS), and Oracle's own advisory row reads like a worst case: CVSS 10.0, exploitable over the network via HTTP, no authentication required, scope changed, high impact to both confidentiality and integrity.
The patch has existed since Oracle's January 2026 Critical Patch Update. That's the part that should worry anyone running older middleware: the fix went only to the version lines Oracle still supports — 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Everything older is in permanent-exposure territory, and the newest of those patched lines is itself months from its own support cliff.
What Oracle's Advisory Actually Says
From the January 2026 Critical Patch Update risk matrix, verbatim facts for CVE-2026-21962:
- Products: Oracle HTTP Server; Oracle WebLogic Server Proxy Plug-in (for Apache HTTP Server and for IIS)
- Attack vector: HTTP over the network, remotely exploitable without authentication
- CVSS 3.1 base score: 10.0 (AV:N / AC:L / PR:N / UI:N / Scope: Changed / C:H / I:H / A:N)
- Weakness class: improper access control (CWE-284, per the KEV entry) — CISA describes unauthorized creation, deletion, modification of and access to critical data
- Supported versions affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0
And the sentence that turns this from a patching story into a lifecycle story — Oracle's standard advisory language, applied to a perfect-score, actively exploited flaw: "Product releases that are not under Premier Support or Extended Support are not tested for the presence of vulnerabilities addressed by this Critical Patch Update. However, it is likely that earlier versions of affected releases are also affected by these vulnerabilities."
That is Oracle telling you, in policy language, that WebLogic 12.1.x and 11g deployments fronted by these proxy plug-ins should be presumed vulnerable — with no fix coming, ever.
The WebLogic Support Map
We now track Oracle WebLogic Server as a product, with dates from Oracle's Fusion Middleware Lifetime Support Policy (Oracle publishes month precision; we date to month-end). "End of support" below is the end of Premier Support:
| Release line | Premier Support ends | Extended Support ends | CVE-2026-21962 patch? | Status |
|---|---|---|---|---|
| WebLogic 15c (15.1.1) | October 31, 2030 | October 31, 2033 | Current release line | Supported |
| WebLogic 14.1.x (14.1.1, 14.1.2) | December 31, 2030 | December 31, 2033 | Yes — patched in Jan 2026 CPU | Supported |
| WebLogic 12.2.x (12.2.1.4) | December 31, 2026 | December 31, 2027 | Yes — patched in Jan 2026 CPU | Premier ends Dec 2026 |
| WebLogic 12.1.x | December 31, 2017 | December 31, 2019 | No — never will be | EOL |
| WebLogic 11g (10.3.x) | December 31, 2018 | December 31, 2021 | No — never will be | EOL |
Two things stand out. First, WebLogic's install base is famously long-tailed — 11g and 12.1 systems still run production workloads at organizations that stopped counting them years ago, often behind exactly the Apache/IIS proxy layer this CVE targets. Second, the "safe" answer of standing pat on 12.2.1.4 has a short shelf life: Premier Support for the entire 12.2 line ends this December. A 12.2.1.4 estate patched today still needs a migration plan — to 14.1.x (supported to December 31, 2030) or 15c — or an Extended Support contract that only buys time until the end of 2027.
Why the Proxy Plug-in Makes This Worse
The vulnerable components are not the application server itself but the modules organizations deploy at the edge: Oracle HTTP Server and the WebLogic Proxy Plug-in are, by design, the internet-facing tier that forwards requests into WebLogic clusters. That architecture means the affected code is precisely the part most likely to be network-reachable — consistent with the advisory's unauthenticated, network-vector scoring, and with how quickly exploitation was observed (the underlying flaw was patched in January; CISA's catalog confirms in-the-wild exploitation as of August).
It also means inventory is harder than "what WebLogic version am I running": the plug-in ships and updates separately, embedded in Apache and IIS tiers that middleware teams don't always own. If nobody in the building can answer "which web tiers run the WebLogic proxy plug-in, and at what patch level," that question is the actual remediation work.
What To Do, By Situation
- Federal civilian agency: the BOD deadline is August 27. Apply the January 2026 (or later) CPU to Oracle HTTP Server and every proxy plug-in deployment, or follow CISA's guidance up to and including discontinuing use.
- On 12.2.1.4, 14.1.1, or 14.1.2: apply the current CPU now — the fix has been available for seven months, and KEV listing means adversaries are actively using the gap. Then, if you're on 12.2.x, put the December 31, 2026 Premier Support end on the migration calendar — the live risk score for the line will only move one direction from here.
- On 12.1.x or 11g: treat the system as presumed-vulnerable and unpatchable. Realistic options: isolate the proxy tier from untrusted networks immediately, and migrate — there is no patch path, and Oracle's Sustaining Support explicitly excludes new security fixes. This is the same "permanently unpatchable" category our Exploited & Unpatchable feed exists to track.
- Not sure what you run: check your estate against the WebLogic lifecycle page, or use the EOL checker as you inventory the web tier.
Frequently Asked Questions
What is CVE-2026-21962?
An improper access control vulnerability (CWE-284) in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server and IIS, patched in Oracle's January 2026 Critical Patch Update. Oracle scores it CVSS 10.0 — network-exploitable over HTTP, no authentication, scope changed, high confidentiality and integrity impact. CISA added it to the KEV catalog on August 24, 2026 with an August 27 due date.
Which versions received the patch?
The supported lines listed in Oracle's advisory: 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Oracle's advisory states that out-of-support releases are not tested but that earlier versions of affected releases are "likely" also affected. 12.1.x and 11g will never receive this fix.
When does WebLogic 12.2 reach end of support?
Premier Support for WebLogic 12.2.x ends December 31, 2026; paid Extended Support runs to December 31, 2027. After that, Sustaining Support provides no new security fixes. Details on the WebLogic lifecycle page.
Does the KEV deadline apply outside the US federal government?
The binding due date applies to federal civilian agencies. For everyone else, KEV listing is the clearest public signal that exploitation is happening in the wild now — most mature security programs treat KEV entries as immediate-action items regardless of sector.