CISA Gives Federal Agencies 72 Hours to Close 7-Month Vulnerability in Oracle WebLogic
The critical vulnerability CVE-2026-21962 in the WebLogic proxy plug-in was patched in January, generated over 140,000 attack attempts in 21 countries, and has only now entered the active exploitation list of the U.S. agency.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962 to its catalog of actively exploited vulnerabilities on Monday. The deadline given to federal agencies for remediation is August 27: three calendar days. The vulnerability, with a maximum severity of CVSS 10.0, affects Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. It allows an unauthenticated attacker to access, modify, or delete all content served by the vulnerable component.
The patch has been available since January 20. Within 48 hours of its release, a proof-of-concept surfaced on GitHub. By February 3, researchers from CloudSEK and Imperva had already recorded 140,000 exploitation attempts across 21 countries. The addition to the Known Exploited Vulnerabilities (KEV) list comes seven months after the vulnerability had been actively exploited in production and weeks after NHS England Digital issued a formal notice to healthcare operators in the UK urging immediate patch application.
The new urgency stems from the Binding Operational Directive BOD 26-04, which Washington began to enforce strictly in the second quarter. Under BOD, items on the KEV list must be patched within short timeframes when exposed to the public internet. Three days, in the case of a critical vulnerability in software that acts as an HTTP proxy in thousands of federal instances, is the operational limit that CISA has been using as a standard for active incidents.
The Technical Engine of the Vulnerability
The issue lies not in WebLogic itself but in the inconsistency between how the Oracle HTTP Server, running the proxy plug-in, normalizes received URIs and how the back-end WebLogic interprets the same path. The double-decoding opens the door for requests to pass through the authentication layer as if they were addressed to public routes, but they reach the back-end with the original path, allowing unrestricted access. It is a variation of a pattern that has previously compromised IIS and Apache proxies in past years, which is why NetSPI classifies the exploitation as trivial to reproduce.
There is no stable intermediate mitigation. Oracle's recommendation is to apply the January patch without exceptions. Where the patch has not yet been applied, the consensus among scanning vendors is to isolate the component behind a WAF configured to reject requests with multiple encodings in the path, with log auditing in search of the specific exploitation pattern.
Where the Real Exposure Lies
In the UK, NHS England Digital published a patch alert for healthcare operators running WebLogic for patient record system integration. British banks still operate WebLogic on legacy front-office stacks. Seven months after the patch and with 140,000 exploitation attempts recorded, the issue returns to the risk management tables in London, supported by CISA's requirement as an international benchmark.
In Japan, WebLogic remains a reference component for integration among major banks and industrial conglomerates. The exploitation is remote and does not require credentials, which increases the risk for teams that still operate instances with partial exposure to the internet even behind firewalls. The addition to the KEV by CISA creates pressure for JPCERT/CC to update its notice, as American benchmarks often influence the auditing guidelines of major Japanese firms.
The Standard CISA is Imposing
Adding a vulnerability patched in January to the KEV is a message to the market. CISA is accepting short detection-to-remediation windows, even when active exploitation has been tolerated for months. For security directors who still treat the KEV as a suggestion list, the signal is different: the agency is now using inclusion as a regulatory hammer, shortening deadlines and requiring evidence of remediation. This applies to the federal sector but serves as a floor expectation for auditors in any jurisdiction that benchmarks against American policy. Security teams that had already been conducting monthly scans on WebLogic will have to confront the uncomfortable question: why did the exposed instance remain exposed between January and August?