US flags exploited Oracle web-server bug with three-day deadline

CISA added an Oracle HTTP Server and WebLogic proxy flaw to its exploited-vulnerabilities catalog on 24 August, with a federal patch deadline of 27 August. Catalog evidence of exploitation — not a claim that Oracle systems went down.

On 24 August 2026, the US Cybersecurity and Infrastructure Security Agency said it had added one vulnerability to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation: CVE-2026-21962, an improper access-control bug in Oracle HTTP Server and the Oracle WebLogic Server proxy plug-in. Federal civilian agencies have until 27 August to remediate it on the terms of Binding Operational Directive 26-04. CISA’s catalog JSON lists the same add date and due date. A catalog listing is a patch-priority notice. It is not a measured outage.

Oracle’s January 2026 Critical Patch Update already scored the bug at 10.0 and said it can be exploited remotely over HTTP without a login, on HTTP Server and WebLogic proxy plug-in versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Confidentiality and integrity impacts are listed as high; availability is none. The news this week is not a brand-new patch. It is CISA’s finding that the flaw is being used in the wild, which starts a three-day federal clock. That tightens cyber conditions for organisations still running those internet-facing products. It does not mean web servers have gone dark.

Sources: CISA alert, 24 August 2026, https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog ; Known Exploited Vulnerabilities catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog ; catalog JSON feed dated 24 August 2026, https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json ; Oracle Critical Patch Update Advisory — January 2026, https://www.oracle.com/security-alerts/cpujan2026.html