Critical Security Vulnerabilities Target Oracle WebLogic and HTTP Server

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a critical vulnerability affecting Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in.

The vulnerability, CVE-2026-21962, carries a CVSS score of 10.0 (Critical) and can be exploited remotely over the network without authentication. A successful attack can result in unauthorized access to or modification of critical data and potentially a complete compromise of affected systems.

The vulnerability affects several supported versions, including 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Oracle released fixes as part of its January 2026 Critical Patch Update (CPU) and strongly recommends applying security patches without delay.

For organizations running Oracle WebLogic Server and related middleware components, keeping systems patched and supported is essential. But identifying the right patches, assessing dependencies, and applying updates safely can be challenging, especially in complex or business-critical environments.

Our Oracle WebLogic Server Support helps you keep your WLS environment secure, stable, and up to date. We can support you with:

• Assessing your current WebLogic environment

• Identifying relevant security patches and updates

• Planning and supporting patching activities

• Troubleshooting WebLogic-related issues

• Maintaining and optimizing your Oracle middleware environment

Don't wait until a security vulnerability becomes an incident.

If you need support with your Oracle WebLogic environment or want to assess your current security and patch status, we would be happy to help.

Get in touch with our Oracle WebLogic experts at Broadpin today.