Oracle HTTP Server and WebLogic proxy in KEV: the 27 August deadline requires inventory today

The signal and the facts that change the decision

CISA added CVE-2026-21962 to KEV on 24 August and set 27 August as the operational deadline. NVD describes unauthenticated HTTP network access, a CVSS 3.1 score of 10.0, and confidentiality and integrity impact in Oracle HTTP Server and the WebLogic Server Proxy Plug-in.

NVD lists affected versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0; for the IIS plug-in, the note limits the affected version to 12.2.1.4.0. CISA classifies exploitation as active, automation as possible, and technical impact as total in its SSVC record; this raises priority but does not confirm local compromise.

The KEV required action is to apply mitigations according to guidance, follow the applicable cloud directive, or discontinue the product when mitigations are unavailable. Application-server-centred inventories can miss the edge plug-in. A seemingly auxiliary proxy can expose the unauthenticated vector and reach critical data or additional products through the scope change described in the CVE.

Decision, limits, and stop condition

Before the deadline, discover not only WebLogic servers but also the proxy layer in Apache and IIS, confirm version and patch state, reduce exposure, and investigate prior requests; if mitigation is unavailable, remove the component from the public path.

Application-server-centred inventories can miss the edge plug-in. A seemingly auxiliary proxy can expose the unauthenticated vector and reach critical data or additional products through the scope change described in the CVE.

Execution and proof of completion

Execution should start by searching packages, apache/iis modules, configuration files, images, and load balancers to establish the real denominator. Then, preserving http, waf, proxy, process, filesystem, identity, and backend logs, then remediating, isolating, or withdrawing every instance. Closure requires hunting anomalous requests and data changes, rotating credentials where exposure warrants it, and testing the end-to-end path.

Closure requires 100% of associated proxies and servers in a proven state, documented investigation of the exposure window, a functional test, assessed credentials, and no ‘unknown’ line without an owner and deadline.

• searching packages, Apache/IIS modules, configuration files, images, and load balancers to establish the real denominator.
• preserving HTTP, WAF, proxy, process, filesystem, identity, and backend logs, then remediating, isolating, or withdrawing every instance.
• hunting anomalous requests and data changes, rotating credentials where exposure warrants it, and testing the end-to-end path.
• Closure requires 100% of associated proxies and servers in a proven state, documented investigation of the exposure window, a functional test, assessed credentials, and no ‘unknown’ line without an owner and deadline.