CISA Warns: Oracle WebLogic Flaw CVE-2026-21962 Is Being Actively Exploited — Here's What Server Operators Must Do
CISA has added CVE-2026-21962 — a maximum-severity, unauthenticated remote code execution vulnerability in Oracle WebLogic Server — to its Known Exploited Vulnerabilities catalog, giving United States federal agencies until August 27 to remediate affected systems. The flaw carries a CVSS score of 10 and was patched by Oracle in its January 2026 update cycle, yet threat actors have been exploiting it continuously ever since, with the earliest activity flagged by CloudSEK at the start of the year. Eight months of sustained attacks against a flawed-but-fixable piece of middleware is precisely the scenario that matters to hosting buyers, sysadmins and infrastructure teams. If your estate includes WebLogic — directly or buried inside a commercial application — this is the moment to verify your patch state rather than assume someone else handled it. Related ServerSpan guide: CVE-2026-12184: PHP-FPM DoS Patch Guide (8.3.32 / 8.4.21 / 8.5.6) . A CVSS 10 RCE That Requires No Credentials CV...