High

Oracle has disclosed a critical security vulnerability affecting its Fusion Middleware suite, specifically the Oracle HTTP Server and the WebLogic Server Proxy Plug-in for Apache HTTP Server and Microsoft IIS. Tracked as CVE-2026-21962, this flaw carries the maximum severity rating with a CVSS 3.1 base score of high, making it an immediate and serious threat to enterprise environments. Because the vulnerability exists in the proxy layer, which is commonly deployed in DMZ environments to forward traffic to backend WebLogic clusters, it exposes core infrastructure to direct and unauthenticated remote exploitation.

The vulnerability is caused by a defect in how the WebLogic Server Proxy Plug-ins handle incoming HTTP requests. An unauthenticated attacker with simple network access can exploit the flaw without user interaction and bypass security controls entirely. The attack complexity is low, but the impact is severe, allowing attackers to gain unauthorized access to sensitive data and manipulate system integrity. This includes the ability to create, delete, or modify data accessible to the Oracle HTTP Server, effectively compromising the server environment.

A major concern is the Scope Change (S:C) metric in the CVSS vector, which indicates that although the flaw exists within the proxy plug-in, a successful exploit can affect components beyond the proxy itself. This allows attackers to potentially pivot from the proxy layer into backend WebLogic systems, expanding the attack surface and increasing the risk of a full infrastructure compromise. While the availability impact is listed as none, the total loss of confidentiality and integrity makes this vulnerability extremely dangerous.

The affected components include the WebLogic Server Proxy Plug-in for Apache HTTP Server and the WebLogic Server Proxy Plug-in for IIS. Vulnerable versions include Oracle HTTP Server / Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, while the IIS Proxy Plug-in is affected on version 12.2.1.4.0. Oracle strongly urges administrators to immediately apply the patches released in its Critical Patch Update (CPU). If patching is not immediately possible, organizations should restrict access to the affected HTTP ports to trusted IP addresses only, although this may disrupt legitimate services.